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BILL 


TO 


Make provision for and in connection with the regulation by OFCOM of 
certain internet services; and to make provision about and in connection with 
OFCOM’s functions in relation to media literacy. 


B 


E IT ENACTED by the Queen’s most Excellent Majesty, by and with the advice and 
consent of the Lords Spiritual and Temporal, and Commons, in this present 


Parliament assembled, and by the authority of the same, as follows: — 


PART 1 


OVERVIEW AND KEY DEFINITIONS 


Overview of Act 


This Act contains provision about the regulation by OFCOM of certain internet 
services (“regulated services”). 


Sections 2 and 3 contain key definitions, including the definition of a regulated 
service. 


Part 2 imposes duties of care on providers of regulated services and requires 
OFCOM to issue codes of practice relating to those duties. 


Part 3 imposes further duties on providers of regulated services. 
Part 4 is about OFCOM’s powers and duties in relation to regulated services. 
Part 5 is about appeals and complaints relating to regulated services. 


Part 6 is about the Secretary of State’s functions in relation to regulated 
services. 


Part 7 makes general and final provision, and includes an index of terms 
defined in this Act (see section 138). 
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(1) 


Meaning of “user-to-user service” and “search service” 


In this Act “user-to-user service” means an internet service by means of which 
content that is generated by a user of the service, or uploaded to or shared on 
the service by a user of the service, may be encountered by another user, or 
other users, of the service. 


In subsection (1) the reference to content that may be encountered by another 
user, or other users, of a service includes content that is capable of being shared 
with such a user or users by operation of a functionality of the service that 
allows the sharing of content. 


For the purposes of subsection (1) it does not matter what proportion of content 
present on a service is content described in that subsection. 


For the meaning of “content” and “encounter”, see section 137. 


In this Act “search service” means an internet service that — 
(a) is, or includes, a search engine (see section 134), and 
(b) is nota user-to-user service. 


For the purposes of this Act, a dissociable part of a user-to-user service, or a 
dissociable part of a search service, is to be regarded as not forming part of the 
service if the conditions in paragraph 4(2) of Schedule 1 (internal business 
services) are satisfied in relation to that part. 


Meaning of “regulated service” 
This section applies for the purposes of this Act. 


“Regulated service” means — 
(a) aregulated user-to-user service, or 
(b) aregulated search service. 


A “regulated user-to-user service” means a user-to-user service that— 
(a) has links with the United Kingdom (see subsections (5) and (6)), and 
(b) isnot exempt (see subsection (7)). 


A “regulated search service” means a search service that — 
(a) has links with the United Kingdom (see subsections (5) and (6)), and 
(b) isnot exempt (see subsection (7)). 


A user-to-user service or a search service “has links with the United Kingdom” 
if— 
(a) the service has a significant number of United Kingdom users, or 
(b) United Kingdom users form one of the target markets for the service (or 
the only target market). 


A user-to-user service or a search service also “has links with the United 
Kingdom” if — 
(a) the service is capable of being used in the United Kingdom by 
individuals, and 
(b) there are reasonable grounds to believe that there is a material risk of 
significant harm to individuals in the United Kingdom arising from — 
(i) in the case of a user-to-user service, content present on the 
service; 
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(7) 


(10) 


(11) 


(12) 


(ii) in the case of a search service, content that may be encountered 
in or via search results. 


A user-to-user service or a search service is exempt if it is a service of a 
description that is exempt as provided for by Schedule 1. 


The Secretary of State may by regulations amend Schedule 1 to provide for a 
further description of user-to-user service or search service to be exempt, if the 
Secretary of State considers that the risk of harm to individuals in the United 
Kingdom presented by a service of that description is low. 


If the condition in subsection (10) is satisfied, the Secretary of State may by 
regulations repeal any of the following — 


(a) paragraph 3 of Schedule 1 (services offering only one-to-one live aural 
communications); 


(b) paragraph 5 of that Schedule (limited functionality services); 


(c) any provision of that Schedule added in exercise of the power in 
subsection (8). 


The condition is that the Secretary of State considers that it is appropriate to 
repeal the provision in question because of the risk of harm to individuals in 
the United Kingdom presented by a service of the description in question. 


The Secretary of State may also by regulations amend any provision of 
Schedule 1 referred to in subsection (9). 


Regulations under subsection (8), (9) or (11) may amend section 39 (meaning of 
“regulated content” etc) in connection with the provision made by the 
regulations. 


PART 2 
PROVIDERS OF REGULATED SERVICES: DUTIES OF CARE 
CHAPTER 1 


INTRODUCTION 


Overview of Part 2 


This Part imposes duties of care on providers of regulated services and 
requires OFCOM to issue codes of practice relating to those duties. 


Chapter 2 imposes duties of care on providers of regulated user-to-user 
services. 


Chapter 3 imposes duties of care on providers of regulated search services. 


Chapter 4 imposes duties on providers of regulated services to assess whether 
a service is likely to be accessed by children. 


Chapter 5 requires OFCOM to issue codes of practice relating to particular 
duties and explains what effects the codes of practice have. 


Chapter 6 is about the interpretation of this Part, and it includes definitions of 
the following key terms — 


“illegal content” (see section 41), 
“content that is harmful to children” (see section 45), and 
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“content that is harmful to adults” (see section 46). 


CHAPTER 2 


PROVIDERS OF USER-TO-USER SERVICES: DUTIES OF CARE 
User-to-user services: duties of care 


Providers of user-to-user services: duties of care 


Subsections (2) to (6) apply to determine which of the duties set out in this 
Chapter and Chapter 3 apply in relation to a particular regulated user-to-user 
service. 


All providers of regulated user-to-user services must comply with the 
following duties in relation to each such service — 
(a) the illegal content risk assessment duty (see section 7(1)), 
(b) each of the illegal content duties (see section 9), 
(c) the duty about rights to freedom of expression and privacy set out in 
section 12(2), 
(d) the duties about reporting and redress set out in— 
(i) section 15(2)(a), and 
(ii) section 15(3) and (5) so far as relating to subsection (4)(a)(i), 
(b)(i) or (ii), (c)(i) or (d)(i) of that section, and 
(e) each of the record-keeping and review duties (see section 16). 


Additional duties apply to providers of particular kinds of regulated user-to- 
user services, as follows. 


All providers of regulated user-to-user services that are likely to be accessed by 
children must comply with the following duties in relation to each such 
service — 
(a) each of the children’s risk assessment duties (see section 7(3) and (4)), 
(b) each of the duties to protect children’s online safety (see section 10), 
and 
(c) the duties about reporting and redress set out in— 
(i) section 15(2)(b), and 
(ii) section 15(3) and (5) so far as relating to subsection (4)(a)/(ii), 
(c)(ii) or (d)(ii) of that section. 
All providers of Category 1 services must comply with the following duties in 
relation to each such service — 
(a) each of the adults’ risk assessment duties (see section 7(6) and (7)), 
(b) each of the duties to protect adults’ online safety (see section 11), 
(c) the duties about rights to freedom of expression and privacy set out in 
section 12(3), (4) and (5), 
(d) each of the duties to protect content of democratic importance (see 
section 13), 
(e) each of the duties to protect journalistic content (see section 14), and 
(f) the duties about reporting and redress set out in— 
(i) section 15(2)(c), and 
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(ii) section 15(3) and (5) so far as relating to subsection (4)(a)(iii), 
(b) (iii) or (iv), (c)(iii) or (d)(iii) of that section. 


(6) All providers of regulated user-to-user services that include a search engine 
must comply with the following duties in relation to the search engine of each 
such service — 


(a) if the service is not likely to be accessed by children, the duties referred 
to in section 17(2); 

(b) if the service is likely to be accessed by children, the duties referred to 
in section 17(2) and (3). 


(7) For the meaning of “Category 1 service”, see section 59 (register of categories 
of services). 


6 Duties of care: supplementary 


A duty set out in this Chapter which must be complied with in relation to a 
user-to-user service extends only to— 


(a) the design and operation of the service in the United Kingdom, or 


(b) in the case of a duty that is expressed to apply in relation to users of a 
service, the design and operation of the service as it affects United 
Kingdom users of the service. 


Risk assessments 


7 Risk assessment duties 


All services 


(1) The “illegal content risk assessment duty” is a duty — 

(a) to carry out an illegal content risk assessment at a time set out in section 

(b) to keep an illegal content risk assessment up to date, including when 
OFCOM make any significant change to a risk profile that relates to 
services of the kind in question, and 

(c) to carry out a further illegal content risk assessment before making any 
significant change to any aspect of the design or operation of a service 
to which such an assessment is relevant. 


Services likely to be accessed by children 


(2) The “children’s risk assessment duties” are the duties set out in subsections (3) 
and (4). 


(3) Aduty— 

(a) to carry out a children’s risk assessment at a time set out in section 8, 

(b) to keep a children’s risk assessment up to date, including when 
OFCOM make any significant change to a risk profile that relates to 
services of the kind in question, and 

(c) to carry out a further children’s risk assessment before making any 
significant change to any aspect of the design or operation of a service 
to which such an assessment is relevant. 
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Where a children’s risk assessment of a service identifies the presence of non- 
designated content that is harmful to children, a duty to notify OFCOM of — 


(a) the kinds of such content identified, and 
(b) the incidence of those kinds of content on the service. 


Category 1 services 


The ‘adults’ risk assessment duties” are the duties set out in subsections (6) 
and (7). 
A duty — 

(a) to carry out an adults’ risk assessment at a time set out in section 8, 

(b) to keep an adults’ risk assessment up to date, including when OFCOM 
make any significant change to a risk profile that relates to services of 
the kind in question, and 

(c) to carry out a further adults’ risk assessment before making any 
significant change to any aspect of the design or operation of a service 
to which such an assessment is relevant. 


Where an adults’ risk assessment of a service identifies the presence of content 
that is harmful to adults, other than priority content that is harmful to adults, 
a duty to notify OFCOM of — 


(a) the kinds of such content identified, and 
(b) the incidence of those kinds of content on the service. 


Definitions 


An “illegal content risk assessment” of a service of a particular kind means an 
assessment to identify, assess and understand such of the following as appear 
to be appropriate, taking into account the risk profile that relates to services of 
that kind — 

(a) the user base; 

(b) the level of risk of individuals who are users of the service encountering 
the following by means of the service — 

(i) terrorism content, 
(ii) CSEA content, 
(iii) priority illegal content, and 
(iv) other illegal content, 
taking into account (in particular) algorithms used by the service, and 
how easily, quickly and widely content may be disseminated by means 
of the service; 

(c) the level of risk of harm to individuals presented by illegal content of 
different descriptions; 

(d) the level of risk of functionalities of the service facilitating the presence 
or dissemination of illegal content, identifying and assessing those 
functionalities that present higher levels of risk; 

(e) the different ways in which the service is used, and the impact that has 
on the level of risk of harm that might be suffered by individuals; 

(f) the nature, and severity, of the harm that might be suffered by 
individuals from the matters identified in accordance with paragraphs 


(b) to (e); 
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(g) how the design and operation of the service (including the business 
model, governance and other systems and processes) may reduce or 
increase the risks identified. 


(9) A “children’s risk assessment” of a service of a particular kind means an 
assessment to identify, assess and understand such of the following as appear 
to be appropriate, taking into account the risk profile that relates to services of 
that kind — 

(a) the user base, including the number of users who are children in 
different age groups; 

(b) the level of risk of children who are users of the service encountering 
the following by means of the service — 

(i) each kind of primary priority content that is harmful to children 
(with each kind separately assessed), 
(ii) each kind of priority content that is harmful to children (with 
each kind separately assessed), and 
(iii) non-designated content that is harmful to children, 
giving separate consideration to children in different age groups, and 
taking into account (in particular) algorithms used by the service and 
how easily, quickly and widely content may be disseminated by means 
of the service; 

(c) the level of risk of harm to children presented by different descriptions 
of content that is harmful to children, giving separate consideration to 
children in different age groups; 

(d) the level of risk of functionalities of the service facilitating the presence 
or dissemination of content that is harmful to children, identifying and 
assessing those functionalities that present higher levels of risk, 
including functionalities — 

(i) enabling adults to search for other users of the service 
(including children), and 

(ii) enabling adults to contact other users (including children) by 
means of the service; 

(e) the different ways in which the service is used, and the impact that has 
on the level of risk of harm that might be suffered by children; 

(f) the nature, and severity, of the harm that might be suffered by children 
from the matters identified in accordance with paragraphs (b) to (e), 
giving separate consideration to children in different age groups; 

(g) how the design and operation of the service (including the business 
model, governance and other systems and processes) may reduce or 
increase the risks identified. 


(10) An “adults’ risk assessment” of a service of a particular kind means an 
assessment to identify, assess and understand such of the following as appear 
to be appropriate, taking into account the risk profile that relates to services of 
that kind — 

(a) the user base; 
(b) the level of risk of adults who are users of the service encountering the 
following by means of the service— 
(i) each kind of priority content that is harmful to adults (with each 
kind separately assessed), and 
(ii) other content that is harmful to adults, 
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taking into account (in particular) algorithms used by the service, and 
how easily, quickly and widely content may be disseminated by means 
of the service; 

(c) the level of risk of harm to adults presented by different descriptions of 
content that is harmful to adults; 

(d) the level of risk of functionalities of the service facilitating the presence 
or dissemination of content that is harmful to adults, identifying and 
assessing those functionalities that present higher levels of risk; 

(e) the different ways in which the service is used, and the impact that has 
on the level of risk of harm that might be suffered by adults; 

(f) the nature, and severity, of the harm that might be suffered by adults 
from the matters identified in accordance with paragraphs (b) to (e); 

(g) how the design and operation of the service (including the business 
model, governance and other systems and processes) may reduce or 
increase the risks identified. 


In this section references to risk profiles are to risk profiles included in 
OFCOM’s guidance about risk assessments (see section 62). 


Timing of risk assessment under section 7 


In the case of a regulated user-to-user service which is in operation 
immediately before the relevant day, a risk assessment must be carried out 
within the period of three months beginning with that day, unless extra time is 
allowed by agreement with OFCOM. 


In the case of a regulated user-to-user service which begins operating on or 
after the relevant day, a risk assessment must be carried out before United 
Kingdom users are able to access the service. 


In the case of a user-to-user service which, having previously not been a 
regulated user-to-user service, becomes a regulated user-to-user service, a risk 
assessment must be carried out — 


(a) before United Kingdom users are able to access the service, or 


(b) if such users were already able to access the service, as soon as 
reasonably practicable after the service becomes a regulated service. 


In this section “the relevant day” means — 


(a) if OFCOM’s report of their risk assessment under section 61 and 
OFCOM’s guidance about risk assessments under section 62 are first 
published on the same day, that day, or 


(b) if that report and that guidance are first published on different days, the 
later of those days. 


In this section “risk assessment” means a risk assessment under section 7(1)(a), 
(3)(a) or (6)(a). 
Safety duties 


Safety duties about illegal content 


The “illegal content duties” in relation to user-to-user services are the duties set 
out in this section. 
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(2) 


(3) 


(7) 
(8) 
10 
(1) 
(2) 


A duty, in relation to a service, to take proportionate steps to mitigate and 
effectively manage the risks of harm to individuals, as identified in the most 
recent illegal content risk assessment of the service. 


A duty to operate a service using proportionate systems and processes 
designed to— 
(a) minimise the presence of priority illegal content; 

(b) minimise the length of time for which priority illegal content is present; 

(c) minimise the dissemination of priority illegal content; 

(d) where the provider is alerted by a person to the presence of any illegal 
content, or becomes aware of it in any other way, swiftly take down 
such content. 


A duty to specify in the terms of service how individuals are to be protected 
from illegal content, addressing each paragraph of subsection (3). 


A duty to ensure that — 


(a) the terms of service referred to in subsection (4) are clear and accessible, 
and 


(b) those terms of service are applied consistently. 


In determining whether a step, system or process is proportionate for the 
purposes of this section, the following must be taken into account — 

(a) all the findings of the most recent illegal content risk assessment 
(including as to levels of risk and as to nature, and severity, of potential 
harm to individuals), and 

(b) the size and capacity of the provider of a service. 


In this section “illegal content risk assessment” has the meaning given by 
section 7(8). 


See also, in relation to duties under this section, section 12(2) (duties about 
rights to freedom of expression and privacy). 


Safety duties for services likely to be accessed by children 


The “duties to protect children’s online safety” in relation to user-to-user 
services are the duties set out in this section. 


A duty, in relation to a service, to take proportionate steps to— 

(a) mitigate and effectively manage the risks of harm to children in 
different age groups, as identified in the most recent children’s risk 
assessment of the service, and 

(b) mitigate the impact of harm arising to children in different age groups 
from content that is harmful to children present on the service. 


A duty to operate a service using proportionate systems and processes 
designed to— 
(a) prevent children of any age from encountering, by means of the service, 
primary priority content that is harmful to children; 
(b) protect children in age groups judged to be at risk of harm from other 
content that is harmful to children (or from a particular kind of such 
content) from encountering it by means of the service. 


A duty to specify in the terms of service — 
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(a) how children of any age are to be prevented from encountering 
primary priority content that is harmful to children (with each kind of 
primary priority content separately covered); 

(b) how children in age groups judged to be at risk of harm from priority 
content that is harmful to children (or from a particular kind of such 
content) are to be protected from encountering it, where they are not 
prevented from doing so (with each kind of priority content separately 
covered); 

(c) how children in age groups judged to be at risk of harm from non- 
designated content that is harmful to children (or from a particular kind 
of such content) are to be protected from encountering it, where they 
are not prevented from doing so. 


A duty to ensure that — 
(a) the terms of service referred to in subsection (4) are clear and accessible, 
and 
(b) those terms of service are applied consistently. 


In determining whether a step, system or process is proportionate for the 
purposes of this section, the following must be taken into account — 
(a) all the findings of the most recent children’s risk assessment (including 
as to levels of risk and as to nature, and severity, of potential harm to 
children), and 


(b) the size and capacity of the provider of a service. 


So far as a duty in this section relates to non-designated content that is harmful 
to children, the duty is to be taken to extend only to addressing risks of harm 
from the kinds of such content that have been identified in the most recent 
children’s risk assessment (if any have been identified). 


References in subsections (3)(b) and (4)(b) and (c) to children in age groups 
judged to be at risk of harm from content that is harmful to children are 
references to children in age groups judged to be at risk of such harm as 
assessed by the provider of a service in the most recent children’s risk 
assessment of the service. 


The duties in this section extend only to such parts of a service as it is possible 
for children to access. 


Section 26(3) applies for the purposes of this subsection as it applies for the 
purposes of an assessment under section 26. 


In this section “children’s risk assessment” has the meaning given by section 
7(9). 


See also, in relation to duties under this section, section 12(2) (duties about 
rights to freedom of expression and privacy). 


Safety duties protecting adults: Category 1 services 


The “duties to protect adults’ online safety” in relation to user-to-user services 
are the duties set out in this section. 


A duty to specify in the terms of service — 
(a) how priority content that is harmful to adults is to be dealt with by the 
service (with each such kind of priority content separately covered), 
and 
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(b) how other content that is harmful to adults, of a kind that has been 
identified in the most recent adults’ risk assessment (if any kind of such 
content has been identified), is to be dealt with by the service. 


(3) A duty to ensure that— 


(a) the terms of service referred to in subsection (2) are clear and accessible, 
and 


(b) those terms of service are applied consistently. 
(4) In this section “adults’ risk assessment” has the meaning given by section 7(10). 


(5) See also, in relation to duties under this section, section 12(2) (duties about 
rights to freedom of expression and privacy). 


Freedom of expression etc 


12 Duties about rights to freedom of expression and privacy 


(1) The duties about rights to freedom of expression and privacy in relation to 
user-to-user services, as referred to in section 5, are the duties set out in this 
section. 


All services 


(2) A duty to have regard to the importance of — 
(a) protecting users’ right to freedom of expression within the law, and 
(b) protecting users from unwarranted infringements of privacy, 
when deciding on, and implementing, safety policies and procedures. 


Category 1 services 


(3) Aduty— 

(a) when deciding on safety policies and procedures, to carry out an 
assessment of the impact that such policies or procedures would have 
on— 

(i) the protection of users’ right to freedom of expression within 
the law, and 

(ii) the protection of users from unwarranted infringements of 
privacy; and 

(b) to carry out an assessment of the impact of adopted safety policies and 
procedures on the matters mentioned in paragraph (a)(i) and (ii). 


(4) Aduty to— 
(a) keep an impact assessment up to date, and 
(b) publish impact assessments. 
(5) A duty to specify in the terms of service, or in a publicly available statement, 


the positive steps that the provider has taken in response to an impact 
assessment to — 


(a) protect users’ right to freedom of expression within the law, and 
(b) protect users from unwarranted infringements of privacy. 


Definitions 
(6) In this section— 
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“impact assessment” means an impact assessment under subsection (3); 


“safety policies and procedures” means policies and procedures designed 
to secure compliance with— 


(a) any of the Chapter 2 safety duties, or 
(b) any of the duties set out in section 15 (reporting and redress). 


Duties to protect content of democratic importance: Category 1 services 


The “duties to protect content of democratic importance” in relation to user-to- 
user services are the duties set out in this section. 


A duty to operate a service using systems and processes designed to ensure 
that the importance of the free expression of content of democratic importance 
is taken into account when making decisions about — 
(a) how to treat such content (especially decisions about whether to take it 
down or restrict users’ access to it), and 
(b) whether to take action against a user generating, uploading or sharing 
such content. 


A duty to ensure that the systems and processes mentioned in subsection (2) 
apply in the same way to a diversity of political opinion. 


A duty to specify in the terms of service the policies and processes that are 
designed to take account of the principle mentioned in subsection (2), 
including, in particular, how that principle is applied to decisions mentioned 
in that subsection. 


A duty to ensure that — 
(a) the terms of service referred to in subsection (4) are clear and accessible, 
and 
(b) those terms of service are applied consistently. 


For the purposes of this section content is “content of democratic importance”, 
in relation to a user-to-user service, if — 


(a) the content is— 
(i) news publisher content in relation to that service, or 
(ii) regulated content in relation to that service; and 


(b) the content is or appears to be specifically intended to contribute to 
democratic political debate in the United Kingdom or a part or area of 
the United Kingdom. 


In this section, the reference to “taking action” against a user is to giving a 
warning to a user, or suspending or banning a user from using a service, or in 
any way restricting a user’s ability to use a service. 


For the meaning of “news publisher content” and “regulated content”, see 
section 39. 


Duties to protect journalistic content: Category 1 services 


The “duties to protect journalistic content” in relation to user-to-user services 
are the duties set out in this section. 


A duty to operate a service using systems and processes designed to ensure 
that the importance of the free expression of journalistic content is taken into 
account when making decisions about — 
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(a) how to treat such content (especially decisions about whether to take it 
down or restrict users’ access to it), and 


(b) whether to take action against a user generating, uploading or sharing 
such content. 


A duty, in relation to a decision by a provider to take down content or to 
restrict access to it, to make a dedicated and expedited complaints procedure 
available to a person who considers the content to be journalistic content and 
who is— 
(a) the user who generated, uploaded or shared the content on the service, 
or 
(b) the creator of the content (see subsection (11)). 


A duty to make a dedicated and expedited complaints procedure available to 
users of a service in relation to a decision by the provider of the service to take 
action against a user because of content generated, uploaded or shared by the 
user which the user considers to be journalistic content. 


A duty to ensure that — 


(a) if a complaint about a decision mentioned in subsection (3) is upheld, 
the content is swiftly reinstated on the service; 


(b) if a complaint about a decision mentioned in subsection (4) is upheld, 
the action against the user is swiftly reversed. 


A duty to specify in the terms of service — 


(a) by what methods content present on the service is to be identified as 
journalistic content; 


(b) how the importance of the free expression of journalistic content is to 
be taken into account when making decisions mentioned in subsection 
(2); 

(c) the policies and processes for handling complaints in relation to 
content which is, or is considered to be, journalistic content. 


A duty to ensure that — 


(a) the terms of service referred to in subsection (6) are clear and accessible, 
and 


(b) those terms of service are applied consistently. 


For the purposes of this section content is “journalistic content”, in relation to 
a user-to-user service, if — 


(a) the content is— 
(i) news publisher content in relation to that service, or 
(ii) regulated content in relation to that service; 
(b) the content is generated for the purposes of journalism; and 
(c) the content is UK-linked. 


For the purposes of this section content is “UK-linked” if — 
(a) United Kingdom users of the service form one of the target markets for 
the content (or the only target market), or 
(b) the content is or is likely to be of interest to a significant number of 
United Kingdom users. 


In this section references to “taking action” against a user are to giving a 
warning to a user, or suspending or banning a user from using a service, or in 
any way restricting a user’s ability to use a service. 
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(11) In this section the reference to a person who is the “creator” of content is a 
reference to any of the following — 
(a) inthe case of news publisher content, the recognised news publisher in 
question; 

(b) anindividual who— 
(i) created the content, and 
(ii) is in the United Kingdom; 

(c) an entity which— 
(i) created the content, and 


(ii) is incorporated or formed under the law of any part of the 
United Kingdom. 


(12) For the meaning of “news publisher content”, “regulated content” and 
“recognised news publisher”, see sections 39 and 40. 


User reporting and redress 


15 Reporting and redress duties 


(1) The duties about reporting and redress in relation to user-to-user services, as 
referred to in section 5, are the duties set out in this section. 


(2) A duty to operate a service using systems and processes that allow users and 
affected persons to easily report content of the following kinds — 


(a) content which they consider to be illegal content; 


(b) content, present on a part of a service that it is possible for children to 
access, which they consider to be content that is harmful to children; 


(c) content which they consider to be content that is harmful to adults. 


(3) A duty to operate a complaints procedure in relation to a service that — 


(a) allows for complaints of the kinds mentioned in subsection (4) to be 
made, 


(b) provides for appropriate action to be taken by the provider of the 
service in response to such complaints, and 


(c) is easy to access, easy to use (including by children) and transparent. 


(4) The kinds of complaints are— 
(a) complaints by users and affected persons about content of the 


following kinds — 
(i) content present on a service which they consider to be illegal 
content; 


(ii) content, present on a part of a service that it is possible for 
children to access, which they consider to be content that is 
harmful to children; 

(iii) content present on a service which they consider to be content 
that is harmful to adults; 
(b) complaints by users and affected persons if they consider that — 
(i) the provider is not complying with a Chapter 2 safety duty that 
applies in relation to the service; 


(ii) the provider is not complying with the duty set out in section 
12(2); 
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(iii) the provider is not complying with any of the duties set out in 
section 12(3) to (5); 
(iv) the provider is not complying with any of the duties set out in 
section 13 or 14; 
(c) complaints by a user who has generated, uploaded or shared content 
on a service if the provider — 
(i) takes down that content because the provider considers that it 
is illegal content; 
(ii) takes down that content or restricts access to it because the 
provider considers that it is content that is harmful to children; 
(iii) takes down that content or restricts access to it because the 
provider considers that it is content that is harmful to adults; 
and 
(d) complaints by a user if the provider has given a warning to the user, 
suspended or banned the user from using the service, or in any other 
way restricted the user’s ability to use the service, as a result of content 
generated, uploaded or shared by the user which the provider 
considers to be — 
(i) illegal content; 
(ii) content that is harmful to children; 
(iii) content that is harmful to adults. 


(5) A duty to make the policies and procedures that govern the handling and 
resolution of complaints as mentioned in subsection (4) publicly available and 
easily accessible (including to children). 


(6) Section 26(3) (access by children to a service) applies for the purposes of 
subsections (2)(b) and (4)(a)(ii) as it applies for the purposes of an assessment 
under section 26. 


(7) Inthis section “affected person” means a person, other than a user of the service 
in question, who is in the United Kingdom and who is — 


(a) the subject of the content, 


(b) amember of a class or group of people with a certain characteristic (or 
combination of characteristics) targeted by the content, 


(c) a parent of, or other adult with responsibility for, a child who is a user 
of the service or is the subject of the content, or 


(d) an adult providing assistance in using the service to another adult who 
requires such assistance, where that other adult is a user of the service 
or is the subject of the content. 


(8) See also, in relation to duties under this section, section 12(2) (duties about 
rights to freedom of expression and privacy). 


Record-keeping and review 


16 Record-keeping and review duties 


(1) The “record-keeping and review duties” in relation to user-to-user services are 
the duties set out in this section. 


(2) A duty to make and keep a written record of every risk assessment carried out 
under section 7. 
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(3) A duty to make and keep a written record of any steps taken to comply with a 
relevant duty other than steps which— 
(a) are described in a code of practice and recommended for the purposes 
of compliance with the duty in question, and 
(b) apply in relation to the provider and the service in question. 


(4) A duty to review compliance with the relevant duties in relation to a service — 
(a) regularly, and 
(b) as soon as reasonably practicable after making any significant change 
to any aspect of the design or operation of the service. 


(5) Where OFCOM consider it to be appropriate, OFCOM may, in relation to a 
particular user-to-user service, exempt the provider of that service from— 
(a) the duty set out in subsection (2), 
(b) the duty set out in subsection (3), or 
(c) the duties set out in subsections (2) and (3). 


— 
OV 
wm 


OFCOM must publish details of any exemption under subsection (5). 


In this section — 
“code of practice” means a code of practice published under section 34; 
“relevant duties” means — 
(a) the Chapter 2 safety duties, 
(b) the duties set out in section 13 (content of democratic 
importance), 
(c) the duties set out in section 14 (journalistic content), and 
(d) the duties set out in section 15 (reporting and redress). 
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CHAPTER 3 


PROVIDERS OF SEARCH SERVICES: DUTIES OF CARE 
Search services: duties of care 


17 Providers of search services: duties of care 


(1) Subsections (2) and (3) apply to determine which of the duties set out in this 
Chapter apply in relation to a particular regulated search service. 


(2) All providers of regulated search services must comply with the following 
duties in relation to each such service — 


(a) the illegal content risk assessment duty (see section 19(1)), 
(b) each of the illegal content duties (see section 21), 
(c) the duty to protect rights to freedom of expression and privacy (see 
section 23), 
(d) the duties about reporting and redress set out in — 
(i) section 24(2) (a), and 
(ii) section 24(3) and (5) so far as relating to subsection (4)(a)(i), (b) 
or (c)(i) of that section, and 
(e) each of the record-keeping and review duties (see section 25). 
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(3) In addition, all providers of regulated search services that are likely to be 
accessed by children must comply with the following duties in relation to each 
such service — 


(a) the children’s risk assessment duty (see section 19(2)), 
(b) each of the duties to protect children’s online safety (see section 22), 
and 
c) the duties about reporting and redress set out in— 
P 8 
(i) section 24(2)(b), and 
(ii) section 24(3) and (5) so far as relating to subsection (4)(a)(ii) or 
(c)(ii) of that section. 


18 Duties of care: supplementary 


(1) A duty set out in this Chapter which must be complied with in relation to a 
search service extends only to— 
(a) the design and operation of the service in the United Kingdom, or 
(b) in the case of a duty that is expressed to apply in relation to users of a 
service, the design and operation of the service as it affects United 
Kingdom users of the service. 


(2) A duty set out in this Chapter which must be complied with in relation to a 
search service does not extend to— 
(a) content present on the website of a recognised news publisher (see 
section 40), or 
(b) content, that may be encountered via search results, that — 

(i) reproduces in full an article or written item that was originally 
published by a recognised news publisher (and is not a 
screenshot or photograph of that article or item or of part of it), 

(ii) is a recording of an item originally broadcast by a recognised 
news publisher (and is not an excerpt of such a recording), or 

(iii) is a link to a full article or written item originally published by 
a recognised news publisher, or to a full recording of an item 
originally broadcast by a recognised news publisher. 


(3) Where duties in this Chapter must be complied with in relation to a search 
engine forming part of a user-to-user service (see section 5(6)), the references 
in subsections (1) and (2) to a search service are to be read as references to the 
search engine. 


Risk assessments 


19 Risk assessment duties 


All services 


(1) The “illegal content risk assessment duty” is a duty — 
(a) to carry out an illegal content risk assessment at a time set out in section 
20, 
(b) to keep an illegal content risk assessment up to date, including when 
OFCOM make any significant change to a risk profile that relates to 
services of the kind in question, and 
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(c) to carry outa further illegal content risk assessment before making any 
significant change to any aspect of the design or operation of a service 
to which such an assessment is relevant. 


Services likely to be accessed by children 


(2) The “children’s risk assessment duty” is a duty — 

(a) to carry out a children’s risk assessment at a time set out in section 20, 

(b) to keep a children’s risk assessment up to date, including when 
OFCOM make any significant change to a risk profile that relates to 
services of the kind in question, and 

(c) to carry out a further children’s risk assessment before making any 
significant change to any aspect of the design or operation of a service 
to which such an assessment is relevant. 


Definitions 


(3) An “illegal content risk assessment” of a service of a particular kind means an 
assessment to identify, assess and understand such of the following as appear 
to be appropriate, taking into account the risk profile that relates to services of 
that kind — 

(a) the level of risk of individuals who are users of the service encountering 
the following in or via search results — 

(i) terrorism content, 
(ii) CSEA content, 
(iii) priority illegal content, and 
(iv) other illegal content, 
taking into account (in particular) risks presented by algorithms used 
by the service, and the way that the service indexes, organises and 
presents search results; 

(b) the level of risk of functionalities of the service facilitating individuals 
encountering illegal content in or via search results, identifying and 
assessing those functionalities that present higher levels of risk; 

(c) the nature, and severity, of the harm that might be suffered by 
individuals from the matters identified in accordance with paragraphs 
(a) and (b); 

(d) how the design and operation of the service (including the business 
model, governance and other systems and processes) may reduce or 
increase the risks identified. 


(4) A “children’s risk assessment” of a service of a particular kind means an 
assessment to identify, assess and understand such of the following as appear 
to be appropriate, taking into account the risk profile that relates to services of 
that kind — 

(a) the level of risk of children who are users of the service encountering 
the following in or via search results — 
(i) each kind of primary priority content that is harmful to children 
(with each kind separately assessed), 
(ii) each kind of priority content that is harmful to children (with 
each kind separately assessed), and 
(iii) non-designated content that is harmful to children, 


giving separate consideration to children in different age groups, and 
taking into account (in particular) risks presented by algorithms used 
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(5) 
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by the service and the way that the service indexes, organises and 
presents search results; 

(b) the level of risk of functionalities of the service facilitating children 
encountering content that is harmful to children in or via search results, 
identifying and assessing those functionalities that present higher 
levels of risk; 

(c) the nature, and severity, of the harm that might be suffered by children 
from the matters identified in accordance with paragraphs (a) and (b), 
giving separate consideration to children in different age groups; 

(d) how the design and operation of the service (including the business 
model, governance and other systems and processes) may reduce or 
increase the risks identified. 


In this section references to risk profiles are to risk profiles included in 
OFCOM’s guidance about risk assessments (see section 62). 


Timing of risk assessment under section 19 


In the case of a regulated search service which is in operation immediately 
before the relevant day, a risk assessment must be carried out within the period 
of three months beginning with that day, unless extra time is allowed by 
agreement with OFCOM. 


In the case of a regulated search service which begins operating on or after the 
relevant day, a risk assessment must be carried out before United Kingdom 
users are able to access the service. 


In the case of a search service which, having previously not been a regulated 
search service, becomes a regulated search service, a risk assessment must be 
carried out — 


(a) before United Kingdom users are able to access the service, or 


(b) if such users were already able to access the service, as soon as 
reasonably practicable after the service becomes a regulated service. 


In this section “the relevant day” means — 


(a) if OFCOM’s report of their risk assessment under section 61 and 
OFCOM’s guidance about risk assessments under section 62 are first 
published on the same day, that day, or 


(b) if that report and that guidance are first published on different days, the 
later of those days. 


In this section “risk assessment” means a risk assessment under section 19(1)(a) 
or (2)(a). 
Safety duties 


Safety duties about illegal content 


The “illegal content duties” in relation to search services are the duties set out 
in this section. 


A duty, in relation to a service, to take proportionate steps to mitigate and 
effectively manage the risks of harm to individuals, as identified in the most 
recent illegal content risk assessment of the service. 
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A duty to operate a service using proportionate systems and processes 
designed to minimise the risk of individuals encountering the following in or 
via search results — 
(a) priority illegal content; 
(b) other illegal content that the provider knows about (having been 
alerted to it by another person or become aware of it in any other way). 


A duty to specify clearly in a publicly available statement details of policies 
and procedures designed to protect individuals from illegal content. 


A duty to apply the policies and procedures mentioned in that statement 
consistently. 


In determining whether a step, system or process is proportionate for the 
purposes of this section, the following must be taken into account — 

(a) all the findings of the most recent illegal content risk assessment 
(including as to levels of risk and as to nature, and severity, of potential 
harm to individuals), and 

(b) the size and capacity of the provider of a service. 


In this section “illegal content risk assessment” has the meaning given by 
section 19(3). 


See also, in relation to duties under this section, section 23(2) (duty about rights 
to freedom of expression and privacy). 


Safety duties for services likely to be accessed by children 


The “duties to protect children’s online safety” in relation to search services are 
the duties set out in this section. 


A duty, in relation to a service, to take proportionate steps to — 

(a) mitigate and effectively manage the risks of harm to children in 
different age groups, as identified in the most recent children’s risk 
assessment of the service, and 

(b) mitigate the impact of harm arising to children in different age groups 
from content that is harmful to children encountered in or via search 
results of the service. 


A duty to operate a service using proportionate systems and processes 
designed to— 
(a) minimise the risk of children of any age encountering primary priority 
content that is harmful to children in or via search results; 
(b) minimise the risk of children in age groups judged to be at risk of harm 
from other content that is harmful to children (or from a particular kind 
of such content) encountering it in or via search results. 


A duty to specify clearly in a publicly available statement details of policies 
and procedures designed to protect children from— 
(a) primary priority content that is harmful to children (with each kind of 
primary priority content separately covered), 
(b) priority content that is harmful to children (with each kind of priority 
content separately covered), and 


(c) non-designated content that is harmful to children. 
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A duty to apply the policies and procedures mentioned in that statement 
consistently. 


In determining whether a step, system or process is proportionate for the 
purposes of this section, the following must be taken into account — 
(a) all the findings of the most recent children’s risk assessment (including 
as to levels of risk and as to nature, and severity, of potential harm to 
children), and 


(b) the size and capacity of the provider of a service. 


So far as a duty in this section relates to non-designated content that is harmful 
to children, the duty is to be taken to extend only to addressing risks of harm 
from the kinds of such content that have been identified in the most recent 
children’s risk assessment (if any have been identified). 


The reference in subsection (3)(b) to children in age groups judged to be at risk 
of harm from content that is harmful to children is a reference to children in age 
groups judged to be at risk of such harm as assessed by the provider of a 
service in the most recent children’s risk assessment of the service. 


The duties in this section extend only to such parts of a service as it is possible 
for children to access. 


Section 26(3) applies for the purposes of this subsection as it applies for the 
purposes of an assessment under section 26. 


In this section “children’s risk assessment” has the meaning given by section 
19(4). 


See also, in relation to duties under this section, section 23(2) (duty about rights 
to freedom of expression and privacy). 


Freedom of expression and privacy 


Duty about rights to freedom of expression and privacy 


The “duty to protect rights to freedom of expression and privacy” in relation to 
search services is the duty set out in this section. 


A duty to have regard to the importance of — 


(a) protecting the rights of users and interested persons to freedom of 
expression within the law, and 


(b) protecting users from unwarranted infringements of privacy, 
when deciding on, and implementing, safety policies and procedures. 


In this section “safety policies and procedures” means policies and procedures 
designed to secure compliance with — 


(a) any of the Chapter 3 safety duties, or 
(b) any of the duties set out in section 24 (reporting and redress). 


User reporting and redress 


Reporting and redress duties 


The duties about reporting and redress in relation to search services, as 
referred to in section 17, are the duties set out in this section. 
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(2) A duty to operate a service using systems and processes that allow users and 
affected persons to easily report content of the following kinds encountered in 
or via search results — 

(a) content which they consider to be illegal content; 
(b) content which they consider to be content that is harmful to children. 


(3) A duty to operate a complaints procedure in relation to a service that — 
(a) allows for complaints of the kinds mentioned in subsection (4) to be 
made, 
(b) provides for appropriate action to be taken by the provider of the 
service in response to such complaints, and 


(c) is easy to access, easy to use (including by children) and transparent. 


(4) The kinds of complaints are— 
(a) complaints by users and affected persons about content of the 
following kinds encountered in or via search results — 
(i) content which they consider to be illegal content; 
(ii) content which they consider to be content that is harmful to 
children; 
(b) complaints by users and affected persons if they consider that — 
(i) the provider is not complying with a Chapter 3 safety duty that 
applies in relation to the service; 
(ii) the provider is not complying with the duty set out in section 
23; 
(c) complaints by an interested person if — 


(i) the provider of a search service takes steps in order to comply 
with duties under section 21 (safety duties about illegal content) 
that result in content relating to that interested person no longer 
appearing in search results or being given a lower priority in 
search results; 

(ii) the provider of a search service takes steps in order to comply 
with duties under section 22 (safety duties for services likely to 
be accessed by children) that result in content relating to that 
interested person no longer appearing in search results or being 
given a lower priority in search results. 


(5) A duty to make the policies and procedures that govern the handling and 
resolution of complaints as mentioned in subsection (4) publicly available and 
easily accessible (including to children). 


(6) Inthis section “affected person” means a person, other than a user of the service 
in question, who is in the United Kingdom and who is — 

(a) the subject of the content, 

(b) amember of a class or group of people with a certain characteristic (or 
combination of characteristics) targeted by the content, 

(c) a parent of, or other adult with responsibility for, a child who is a user 
of the service or is the subject of the content, or 

(d) an adult providing assistance in using the service to another adult who 
requires such assistance, where that other adult is a user of the service 
or is the subject of the content. 


(7) See also, in relation to duties under this section, section 23(2) (duty about rights 
to freedom of expression and privacy). 
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Record-keeping and review 


Record-keeping and review duties 


The “record-keeping and review duties” in relation to search services are the 
duties set out in this section. 


A duty to make and keep a written record of every risk assessment carried out 
under section 19. 


A duty to make and keep a written record of any steps taken to comply with a 
relevant duty other than steps which— 


(a) are described in a code of practice and recommended for the purposes 
of compliance with the duty in question, and 


(b) apply in relation to the provider and the service in question. 


A duty to review compliance with the relevant duties in relation to a service — 
(a) regularly, and 
(b) as soon as reasonably practicable after making any significant change 
to any aspect of the design or operation of the service. 


Where OFCOM consider it to be appropriate, OFCOM may, in relation to a 
particular search service, exempt the provider of that service from— 


(a) the duty set out in subsection (2), 
(b) the duty set out in subsection (3), or 
(c) the duties set out in subsections (2) and (3). 


OFCOM must publish details of any exemption under subsection (5). 


In this section — 
“code of practice” means a code of practice published under section 34; 
“relevant duties” means — 
(a) the Chapter 3 safety duties, and 
(b) the duties set out in section 24 (reporting and redress). 


CHAPTER 4 


ASSESSMENT ABOUT ACCESS BY CHILDREN 


Assessment about access by children 


A provider of a regulated service must, at a time set out in section 27, carry out 
an assessment — 
(a) to determine whether it is possible for children to access the service or 
any part of the service, and 
(b) if it is possible for children to access the service or any part of the 
service, to determine whether the child user condition is met in relation 
to the service or any part of the service. 


If a provider provides more than one regulated service, an assessment under 
subsection (1) must be carried out for each service separately. 


A provider is only entitled to conclude that it is not possible for children to 
access a service, or a part of it, if there are systems or processes in place that 
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achieve the result that children are not normally able to access the service or 
that part of it. 


The “child user condition” is met in relation to a service, or a part of a service, 
if— 
(a) there are a significant number of children who are users of the service 
or of that part of it, or 


(b) the service, or that part of it, is of a kind likely to attract a significant 
number of users who are children. 


For the purposes of this Part, a service is to be treated as “likely to be accessed 
by children” if the provider’s assessment of the service concludes that — 


(a) it is possible for children to access the service or any part of it, and 
(b) the child user condition is met in relation to— 

(i) the service, or 

(ii) a part of the service that it is possible for children to access. 


If a service is not treated as “likely to be accessed by children” for the purposes 
of this Part, the provider must carry out a further assessment under this 
section — 
(a) before making any significant change to any aspect of the design or 
operation of the service, 
(b) in response to evidence about reduced effectiveness of any systems or 
processes that are in place as mentioned in subsection (3), or 
(c) in response to evidence about a significant increase in the number of 
children using the service. 


A provider must keep written records of every assessment under this section. 


If a provider fails to carry out an assessment of a service as required by this 
section, that service is to be treated as “likely to be accessed by children” for the 
purposes of this Part until such time as the provider carries out an assessment. 


For the purposes of subsection (4) — 

(a) the reference to a “significant” number includes a reference to a number 
which is significant in proportion to the total number of United 
Kingdom users of a service or (as the case may be) a part of a service; 

(b) whether the test in paragraph (a) of that subsection is met is to be based 
on evidence about who actually uses a service, rather than who the 
intended users of the service are. 


In this section references to children are to children in the United Kingdom. 


Timing of assessment under section 26 


In the case of a regulated service which is in operation immediately before the 
day on which OFCOM first publish guidance under section 28, an assessment 
must be carried out within the period of three months beginning with that day, 
unless extra time is allowed by agreement with OFCOM. 


In the case of a regulated service which begins operating on or after the day 
referred to in subsection (1), an assessment must be carried out before United 
Kingdom users are able to access the service. 
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(3) Inthe case of a user-to-user service or search service which, having previously 
not been a regulated service, becomes a regulated service, an assessment must 
be carried out — 

(a) before United Kingdom users are able to access the service, or 
(b) if such users were already able to access the service, as soon as 
reasonably practicable after the service becomes a regulated service. 


—~ 
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In this section “assessment” means an assessment under section 26(1). 


— 
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In its application to a service not yet accessed by United Kingdom users, 
section 26 is to be read with the necessary modifications. 


28 OFCOM?’s guidance about assessments under section 26 


(1) OFCOM must prepare guidance for providers of regulated services to assist 
them in complying with their duties to carry out assessments under section 26. 


(2) OFCOM must publish the guidance (and any revised or replacement 
guidance). 


CHAPTER 5 


CODES OF PRACTICE 


29 Codes of practice about duties 


(1) OFCOM must prepare a code of practice for providers of regulated services 
describing recommended steps for the purposes of compliance with duties set 
out in section 9 or 21 (safety duties about illegal content) so far as relating to 
terrorism content. 


(2) OFCOM must prepare a code of practice for providers of regulated services 
describing recommended steps for the purposes of compliance with duties set 
out in section 9 or 21 (safety duties about illegal content) so far as relating to 
CSEA content. 


(3) OFCOM must prepare one or more codes of practice for providers of regulated 
services describing recommended steps for the purposes of compliance with 
the relevant duties (except to the extent that steps for the purposes of 
compliance with such duties are described in a code of practice prepared under 
subsection (1) or (2)). 


(4) Where a code of practice under this section is in force, OFCOM may — 
(a) prepare amendments of the code of practice; 
(b) prepare a code of practice under subsection (1), (2) or (3) as a 
replacement for a code of practice previously prepared under the 
subsection in question; 


(c) withdraw the code of practice. 


(5) Before preparing a code of practice or amendments under this section, OFCOM 
must consult — 
(a) the Secretary of State, 


(b) persons who appear to OFCOM to represent providers of regulated 
services, 
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persons who appear to OFCOM to represent the interests of United 
Kingdom users of regulated services, 


persons who appear to OFCOM to represent the interests of children 
(generally or with particular reference to online safety matters), 


persons who appear to OFCOM to represent the interests of persons 
who have suffered harm as a result of encountering content online, 
persons whom OFCOM consider to have relevant expertise in equality 
issues and human rights, in particular — 


(i) the right to freedom of expression set out in Article 10 of the 
Convention, and 
(ii) the right to respect for a person’s private and family life, home 
and correspondence set out in Article 8 of the Convention, 
persons whom OFCOM consider to have expertise in public health, 
science or medicine that is relevant to online safety matters, 


persons whom OFCOM consider to have expertise in innovation, or 
emerging technology, that is relevant to online safety matters, and 


such other persons as OFCOM consider appropriate. 


(6) Before preparing a code of practice or amendments to which this subsection 
applies, OFCOM must also consult persons whom OFCOM consider to have 
expertise in the enforcement of the criminal law and the protection of national 
security that is relevant to online safety matters. 


(7) Subsection (6) applies to— 


(a) 
(b) 
(c) 


(d) 


a code of practice under subsection (1) and amendments of such a code, 
a code of practice under subsection (2) and amendments of such a code, 
a code of practice under subsection (3) that describes recommended 
steps for the purposes of compliance with duties set out in section 9 or 
21 (safety duties about illegal content), and 

amendments of a code of practice under subsection (3), if and to the 
extent that those amendments relate to steps recommended for the 
purposes of compliance with duties set out in section 9 or 21. 


(8) Subsections (5) and (6) are subject to section 35 (minor amendments of code of 
practice). 


(9) In this section “the relevant duties” means — 


the Chapter 2 safety duties, 

the Chapter 3 safety duties, 

the duties set out in section 13 (content of democratic importance), 
the duties set out in section 14 (journalistic content), and 

the duties set out in sections 15 and 24 (reporting and redress). 


30 Online safety objectives 


(1) OFCOM must ensure that steps described in the codes of practice prepared 
under section 29 are compatible with pursuit of the online safety objectives. 


(2) The online safety objectives for regulated user-to-user services are — 


(a) 


to design and operate a service in such a way that — 
(i) the systems and processes for regulatory compliance and risk 
management are effective and proportionate to the size and 
nature of the service, 


10 


15 


20 


25 


30 


35 


40 


45 


Online Safety Bill 27 
Part 2 — Providers of regulated services: duties of care 
Chapter 5 — Codes of practice 


(ii) the systems and processes are appropriate to deal with the 
number of users of the service and its user base, 


(iii) United Kingdom users (including children) are made aware of, 
and can understand, the terms of service, 


(iv) there are adequate systems and processes to support United 
Kingdom users, 


(v) the service provides a higher standard of protection for children 


than for adults, 
(vi) the different needs of children at different ages are taken into 
account, 
(vii) there are adequate controls over access to the service by adults, 
and 


(viii) there are adequate controls over access to, and use of, the 
service by children, taking into account use of the service by, 
and impact on, children in different age groups; and 


(b) to design and assess the service with a view to protecting United 
Kingdom users from harm, including with regard to— 


(i) algorithms used by the service, 
(ii) functionalities of the service, and 
(iii) other features relating to the operation of the service. 


(3) The online safety objectives for regulated search services are — 
(a) to design and operate a service in such a way that — 

(i) the systems and processes for regulatory compliance and risk 
management are effective and proportionate to the size and 
nature of the service, 

(ii) the systems and processes are appropriate to deal with the 
number of users of the service and its user base, 

(iii) United Kingdom users (including children) are made aware of, 
and can understand, the publicly available statement referred to 
in sections 21 and 22, 

(iv) there are adequate systems and processes to support United 
Kingdom users, 

(v) the service provides a higher standard of protection for children 

than for adults, and 
(vi) the different needs of children at different ages are taken into 
account; 
(b) to assess use of the service by, and impact on, children in different age 
groups; and 
(c) to design and assess the search engine with a view to protecting United 
Kingdom users from harm, including with regard to— 

(i) algorithms used by the search engine, 

(ii) functionalities relating to searches (such as a predictive search 
functionality), and 
(iii) the indexing, organisation and presentation of search results. 


(4) Inthe case of a regulated user-to-user service that includes a search engine, the 
online safety objectives set out in subsection (3) apply in relation to the search 
engine (and accordingly references in that subsection to a search service are to 
be read as references to the search engine). 
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(5) The Secretary of State may by regulations amend subsection (2) or (3) so as to 
vary the online safety objectives for regulated user-to-user services or 
regulated search services. 


(6) If regulations are made amending the online safety objectives, OFCOM must, 
as soon as reasonably practicable afterwards, consider whether a review of the 
codes of practice published under section 34 is required and, if OFCOM 
consider that it is required, carry out a review to assess whether any 
amendments are needed to reflect the revised objectives. 


(7) See section 36(8) and (9) for further provision about the online safety objectives. 


31 Further provision about codes of practice 


(1) In preparing a code of practice or amendments under section 29, OFCOM 
must — 

(a) consider the appropriateness of provisions of the code of practice to 
different kinds and sizes of regulated services and to providers of 
differing kinds, sizes and capacities; 

(b) have regard to the following principles — 

(i) the principle that providers of regulated services must be able 
to understand which provisions of the code of practice apply in 
relation to a particular service they provide; 

(ii) the principle that the steps described in the code of practice 
must be sufficiently clear, and at a sufficiently detailed level, 
that providers understand what those steps entail in practice; 

(iii) the principle that the steps described in the code of practice 
must be proportionate and feasible, recognising that steps that 
are proportionate or feasible for providers of a certain kind, size 
or capacity may not be proportionate or feasible for providers of 
a different kind, size or capacity; 

(iv) the principle that the steps described in the code of practice that 
apply in relation to regulated services of various kinds and sizes 
must be proportionate to OFCOM’s assessment (under section 
61) of the risk of harm presented by services of that kind or size. 


(2) A code of practice under section 29 may — 
(a) make different provision with regard to— 
(i) regulated user-to-user services, and 
(ii) regulated search services; 


(b) make different provision with regard to regulated user-to-user services 
of different kinds or regulated search services of different kinds; and 


(c) otherwise differentiate between regulated services, and between 
providers of regulated services, in such manner as OFCOM consider 
appropriate. 


3) A code of practice under section 29 may apply in relation to a person who 
P y apply P 
provides a regulated service from outside the United Kingdom. 


(4) Steps described in a code of practice under section 29 may relate only to the 
design or operation of a regulated service — 


(a) inthe United Kingdom, or 
(b) as it affects United Kingdom users of the service. 
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(5) Steps described in a code of practice under section 29 which are recommended 
for the purposes of compliance with any of the relevant duties must be 
designed in the light of the principles mentioned in subsection (6) and (where 
appropriate) incorporate safeguards for the protection of the matters 
mentioned in the principles. 


(6) The principles are— 

(a) the importance of protecting the right of users and (in the case of search 
services) interested persons to freedom of expression within the law, 
and 

(b) the importance of protecting users from unwarranted infringements of 
privacy. 


(7) In this section “the relevant duties” has the meaning given by section 29(9). 


32 Approval of codes of practice 


(1) OFCOM must submit a code of practice prepared under section 29 to the 
Secretary of State. 


(2) Unless the Secretary of State intends to give a direction to OFCOM under 
section 33(1) in relation to the code of practice, the Secretary of State must, as 
soon as reasonably practicable, lay the code of practice before Parliament. 


(3) If, within the 40-day period, either House of Parliament resolves not to 
approve the code of practice — 
(a) OFCOM must not issue the code of practice, and 
(b) OFCOM must prepare another version of the code of practice. 


(4) If no such resolution is made within that period — 
(a) OFCOM must issue the code of practice, and 


(b) the code of practice comes into force at the end of the period of 21 days 
beginning with the day on which it is issued. 


(5) In this section, “the 40-day period” means — 
(a) if the code of practice is laid before both Houses of Parliament on the 
same day, the period of 40 days beginning with that day, or 
(b) if the code of practice is laid before the Houses of Parliament on 
different days, the period of 40 days beginning with the later of those 
days. 


(6) Incalculating the 40-day period, no account is to be taken of any period during 
which Parliament is dissolved or prorogued or during which both Houses of 
Parliament are adjourned for more than 4 days. 


(7) This section applies in relation to amendments of a code of practice prepared 
under section 29 (see subsection (4)(a) of that section) as it applies in relation to 
a code of practice prepared under that section. 


(8) This section is subject to section 35 (minor amendments of codes of practice). 


33 Secretary of State’s power of direction 


(1) The Secretary of State may direct OFCOM to modify a code of practice 
submitted under section 32(1) where the Secretary of State believes that 
modifications are required — 
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(a) to ensure that the code of practice reflects government policy, or 


(b) inthe case of a code of practice under section 29(1) or (2), for reasons of 
national security or public safety. 


A direction given under this section — 

(a) may not require OFCOM to include in a code of practice provision 
about a particular step recommended to be taken by providers of 
regulated services, and 

(b) must set out the Secretary of State’s reasons for requiring modifications 
(except in a case where the Secretary of State considers that doing so 
would be against the interests of national security or against the 
interests of relations with the government of a country outside the 
United Kingdom). 


Where the Secretary of State gives a direction to OFCOM, OFCOM must, as 
soon as reasonably practicable — 
(a) comply with the direction, 
(b) submit to the Secretary of State the code of practice modified in 
accordance with the direction, 
(c) submit to the Secretary of State a document containing — 
(i) (except in a case mentioned in subsection (2)(b)) details of the 
direction, and 
(ii) details about how the code of practice has been revised in 
response to the direction, and 
(d) inform the Secretary of State about modifications that OFCOM have 
made to the code of practice that are not in response to the direction (if 
there are any). 


The Secretary of State may give OFCOM one or more further directions 
requiring OFCOM to modify the code of practice for the reasons mentioned in 
paragraph (a) or (b) of subsection (1), and subsections (2) and (3) apply again 
in relation to any such further direction. 


When the Secretary of State is satisfied that no further modifications to the code 
of practice are required, the Secretary of State must, as soon as reasonably 
practicable, lay the modified code of practice before Parliament, together with 
any document submitted by OFCOM as mentioned in subsection (3)(c). 


Subsections (3) to (6) of section 32 apply in relation to a modified code of 
practice laid under subsection (5) as they apply in relation to a code of practice 
laid under subsection (2) of that section. 


This section applies in relation to amendments of a code of practice submitted 
under section 32(1) as it applies in relation to a code of practice submitted 
under that provision. 


Publication and review of codes of practice 


OFCOM must publish each code of practice issued under section 32(4)(a) 
within the period of three days beginning with the day on which it is issued. 


Where amendments of a code of practice are issued under that provision, 
OFCOM must publish the amended code of practice within the period of three 
days beginning with the day on which the amendments are issued. 
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(3) Where a code of practice is withdrawn, OFCOM must publish a notice to that 
effect. 


(4) Publication under this section must be in any manner that OFCOM consider 
appropriate. 


(5) OFCOM must keep under review each code of practice published under this 
section. 


(6) The Secretary of State may at any time require OFCOM to review a code of 
practice prepared under section 29(1) or (2). 


35 Minor amendments of codes of practice 


(1) This section applies if — 
(a) OFCOM propose to prepare amendments of a code of practice under 
section 29, and 
(b) OFCOM consider that the minor nature of the amendments means 
that — 
(i) consultation is unnecessary, and 
(ii) the amendments (once prepared) should not be required to be 
laid before Parliament. 


(2) OFCOM must notify the Secretary of State of OFCOM’s proposed 
amendments. 


(3) If the Secretary of State agrees with OFCOM that it is appropriate — 
(a) the consultation requirements set out in section 29(5) and (6) do not 
apply in relation to the proposed amendments, and 
(b) section 32 does not apply to the amendments, once prepared. 


(4) If the Secretary of State agrees with OFCOM as mentioned in subsection (3), 
OFCOM may prepare and issue the amendments of the code of practice. 


(5) Amendments of a code of practice issued under this section come into force at 
the end of the period of 21 days beginning with the day on which the 
amendments are issued. 


(6) Section 34(2) applies in relation to amendments of a code of practice issued 
under this section as it applies in relation to amendments of a code of practice 
issued under section 32. 


36 Relationship between duties and codes of practice 


(1) A provider of a regulated user-to-user service is to be treated as complying 
with a duty set out in section 10 (safety duties for services likely to be accessed 
by children), 11 (safety duties protecting adults), 13 (content of democratic 
importance), 14 (journalistic content) and 15 (reporting and redress duties) if 
the provider takes the steps described in a code of practice which are 
recommended for the purposes of compliance with the duty in question (so far 
as the steps are relevant to the provider and the service in question). 


(2) A provider of a regulated user-to-user service is to be treated as complying 
with a duty set out in section 9 (safety duties about illegal content) if — 

(a) the provider takes the steps described in a code of practice which are 

recommended for the purposes of compliance with the duty in 
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question (so far as the steps are relevant to the provider and the service 
in question), and 
(b) OFCOM are satisfied that— 
(i) terrorism content is not prevalent, and is not persistently 
present, on the service, and 
(ii) CSEA content is not prevalent, and is not persistently present, 
on the service. 


A provider of a regulated search service is to be treated as complying with a 
duty set out in section 22 (safety duties for services likely to be accessed by 
children) and 24 (reporting and redress duties) if the provider takes the steps 
described in a code of practice which are recommended for the purposes of 
compliance with the duty in question (so far as the steps are relevant to the 
provider and the service in question). 


A provider of a regulated search service is to be treated as complying with a 
duty set out in section 21 (safety duties about illegal content) if — 


(a) the provider takes the steps described in a code of practice which are 
recommended for the purposes of compliance with the duty in 
question (so far as the steps are relevant to the provider and the service 
in question), and 

(b) OFCOM are satisfied that — 


(i) terrorism content is not prevalent, and is not persistently 
present, in search results of the service, and 

(ii) CSEA content is not prevalent, and is not persistently present, 
in search results of the service. 


A provider of a regulated user-to-user service is to be treated as complying 
with the duty set out in section 12(2) (duty about freedom of expression and 
privacy) if the provider takes such of the steps described in a code of practice 
which are recommended for the purposes of compliance with a Chapter 2 
safety duty (so far as the steps are relevant to the provider and the service in 
question) as incorporate safeguards for — 

(a) the protection of users’ right to freedom of expression within the law, 

or 


(b) the protection of users from unwarranted infringements of privacy. 


A provider of a regulated search service is to be treated as complying with the 
duty set out in section 23(2) (duty about freedom of expression and privacy) if 
the provider takes such of the steps described in a code of practice which are 
recommended for the purposes of compliance with a Chapter 3 safety duty (so 
far as the steps are relevant to the provider and the service in question) as 
incorporate safeguards for — 

(a) the protection of the rights of users and interested persons to freedom 

of expression within the law, or 


(b) the protection of users from unwarranted infringements of privacy. 


A failure by a provider of a regulated service to act in accordance with a 
provision of a code of practice does not of itself make the provider liable to 
legal proceedings in a court or tribunal. 


A provider of a regulated service who seeks to comply with a relevant duty by 
acting otherwise than by taking a step described in a code of practice which is 
recommended for the purposes of compliance with the duty must have regard 
to the following — 
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(a) the online safety objectives (so far as they are relevant to the service and 
the duty in question), and 
(b) the importance of the following (where relevant) — 


(i) protecting the right of users and (in the case of search services) 
interested persons to freedom of expression within the law, and 


(ii) protecting users from unwarranted infringements of privacy. 


(9) When assessing whether a provider of a regulated service is compliant with a 
relevant duty where the provider has acted otherwise than by taking a step 
described in a code of practice which is recommended for the purposes of 
compliance with the duty, OFCOM must consider the extent to which the 
alternative steps taken by the provider — 


(a) achieve the online safety objectives (so far as they are relevant to the 
service and the duty in question), and 


(b) (where appropriate) incorporate safeguards for the protection of the 
matters mentioned in subsection (8)(b). 


(10) In subsections (3), (4) and (6), references to a provider of a regulated search 
service include references to a provider of a regulated user-to-user service that 
includes a search engine (see section 5(6)). 


(11) In this section— 
“code of practice” means a code of practice published under section 34; 


“online safety objectives” means the objectives set out in section 30(2) or 
(3) (as the case may be), as amended from time to time; 


“relevant duties” means — 
(a) the Chapter 2 safety duties, 
(b) the Chapter 3 safety duties, 
(c) the duties set out in section 13 (content of democratic 
importance), 
(d) the duties set out in section 14 (journalistic content), and 
(e) the duties set out in sections 15 and 24 (reporting and redress). 


37 Effect of codes of practice 
(1) A code of practice is admissible in evidence in legal proceedings. 


(2) In any proceedings in a court or tribunal, the court or tribunal must take into 
account a provision of a code of practice in determining a question arising in 
the proceedings if — 

(a) the question relates to a time when the provision was in force, and 


b) the provision appears to the court or tribunal to be relevant to the 
p! pp 
question. 


(3) OFCOM must take into account a provision of a code of practice in 
determining a question arising in connection with their exercise of any relevant 
function if — 


(a) the question relates to a time when the provision was in force, and 
(b) the provision appears to OFCOM to be relevant to the question. 


(4) In this section— 
“code of practice” means a code of practice published under section 34; 
“relevant functions” means OFCOM’s functions under — 
(a) Chapter 4 of Part 4 (use of technology), 
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(b) Chapter 5 of Part 4 (information), 
(c) Chapter 6 of Part 4 (enforcement), and 
(d) Chapter 2 of Part 5 (super-complaints). 


38 Duties and the first codes of practice 


(1) A duty mentioned in subsection (2) applies to providers of regulated services 
from the day on which a code of practice prepared under section 29(3) that is 
the first code of practice relating to that duty comes into force. 


(2) The duties referred to in subsection (1) are— 
(a) the Chapter 2 safety duties, 
(b) the Chapter 3 safety duties, 
(c) the duties set out in section 13 (content of democratic importance), 
(d) the duties set out in section 14 (journalistic content), and 
(e) the duties set out in sections 15 and 24 (reporting and redress). 


(3) For the purposes of subsection (1) a code of practice is the first code of practice 


relating to a duty if— 
(a) it describes recommended steps for the purposes of compliance with 
that duty, and 


(b) itis the first code of practice prepared under section 29(3) that describes 
steps for those purposes. 


(4) The duties set out in sections 9 and 21 (safety duties about illegal content), so 
far as relating to terrorism content, apply to providers of regulated services 
from the day on which the first code of practice prepared under section 29(1) 
comes into force. 


(5) The duties set out in sections 9 and 21, so far as relating to CSEA content, apply 
to providers of regulated services from the day on which the first code of 
practice prepared under section 29(2) comes into force. 


(6) Inthe case of the duties set out in sections 9 and 21, subsection (1) is subject to 
subsections (4) and (5). 


(7) In relation to the provider of a particular regulated service, references in this 
section to duties applying to providers of regulated services are to such duties 
as apply in relation to that service in accordance with provision made by 
sections 5 and 17. 


CHAPTER 6 


INTERPRETATION OF PART 2 


39 Meaning of “regulated content”, “user-generated content” and “news 
publisher content” 


(1) This section applies for the purposes of this Part. 
(2) “Regulated content”, in relation to a regulated user-to-user service, means 
user-generated content, except — 
(a) emails, 
(b) SMS messages, 
(c) MMS messages, 
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(4) 


) comments and reviews on provider content (see subsection (5)), 

(e) one-to-one live aural communications (see subsection (6)), 
) paid-for advertisements (see subsection (7)), and 

(g) news publisher content (see subsection (8)). 


“User-generated content”, in relation to a user-to-user service, means content — 
(a) that is— 
(i) generated by a user of the service, or 
(ii) uploaded to or shared on the service by a user of the service, 
and 
(b) that may be encountered by another user, or other users, of the service 
by means of the service. 


For the purposes of subsection (3) — 

(a) the reference to content generated, uploaded or shared by a user 
includes content generated, uploaded or shared by means of software 
or an automated tool applied by the user; 

(b) a bot is to be regarded as a user of a service if — 

(i) the bot’s functions include interacting with user-generated 
content, and 

(ii) the bot is not operated by or on behalf of the provider of the 
service. 


“Comments and reviews on provider content”, in relation to a user-to-user 
service, means content present on the service consisting of comments on, or 
reviews of, content produced and published on the service by the provider of 
the service or by a person acting on behalf of the provider (together with any 
further comments on such comments or reviews). 


“One-to-one live aural communications”, in relation to a user-to-user service, 
means content consisting of communications made in real time between users 
of the service by means of the service, if (and only if) — 
(a) the communications consist solely of speech or other sounds conveyed 
between two users, 
(b) the communications do not include, and are not accompanied by, any 
written message, video or other visual image, and 
(c) the content is not a recording of such communications. 


An advertisement present on a user-to-user service or (as the case may be) in 
search results is a “paid-for advertisement” if — 

(a) the provider of the service receives any consideration (monetary or 
non-monetary) for the advertisement (whether directly from the 
advertiser or indirectly from another person), and 

(b) the placement of the advertisement is determined by systems or 
processes (human or automated) that are agreed between the parties 
entering into the contract relating to the advertisement. 


“News publisher content”, in relation to a regulated user-to-user service, 
means any content present on the service that is within subsection (9) or (10). 


Content is within this subsection if it was generated directly on the service by 
a user of the service that is a recognised news publisher. 


Content is within this subsection if — 
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(a) the content was uploaded to or shared on the service by a user of the 
service, and 
(b) the content either— 

(i) reproduces in full an article or written item that was originally 
published by a recognised news publisher (and is not a 
screenshot or photograph of that article or item or of part of it), 

(ii) is a recording of an item originally broadcast by a recognised 
news publisher (and is not an excerpt of such a recording), or 

(iii) is a link to a full article or written item originally published by 
a recognised news publisher, or to a full recording of an item 
originally broadcast by a recognised news publisher. 


(11) For the meaning of “recognised news publisher”, see section 40. 


(12) The Secretary of State may by regulations repeal subsections (2)(d) and (5) if 
the Secretary of State considers that it is appropriate to do so because of the risk 
of harm to individuals in the United Kingdom presented by comments and 
reviews on provider content. 


(13) The Secretary of State may by regulations repeal subsections (2)(e) and (6) if the 
Secretary of State considers that it is appropriate to do so because of the risk of 
harm to individuals in the United Kingdom presented by one-to-one live aural 
communications. 


(14) In this section— 


“MMS message” means a Multimedia Messaging Service message (that 
may include images, sounds and short videos) that may be sent 
between telephone numbers allocated in accordance with a national or 
international numbering plan; 


“SMS message” means a Short Message Service text message composed 
principally of letters or numbers that may be sent between telephone 
numbers allocated in accordance with a national or international 
numbering plan. 


40 Meaning of “recognised news publisher” 


(1) In this Part, “recognised news publisher” means any of the following entities — 
(a) the British Broadcasting Corporation, 
(b) Sianel Pedwar Cymru, 


(c) the holder of a licence under the Broadcasting Act 1990 or 1996 who 
publishes news-related material in connection with the broadcasting 
activities authorised under the licence, and 


(d) any other entity which— 
(i) meets all of the conditions in subsection (2), and 
(ii) is not an excluded entity (see subsection (3)). 


(2) The conditions referred to in subsection (1)(d)(i) are that the entity — 


(a) has as its principal purpose the publication of news-related material, 
and such material — 


(i) is created by different persons, and 
(ii) is subject to editorial control, 


(b) publishes such material in the course of a business (whether or not 
carried on with a view to profit), 


(c) is subject to a standards code, 
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(d) has policies and procedures for handling and resolving complaints, 
(e) has a registered office or other business address in the United 
Kingdom, 
(f) isthe person with legal responsibility for material published by it in the 
United Kingdom, and 
(g) publishes — 
(i) the entity’s name, the address mentioned in paragraph (e) and 
the entity’s registered number (if any), and 
(ii) the name and address of any person who controls the entity 
(including, where such a person is an entity, the address of that 
person’s registered or principal office and that person’s 
registered number (if any)). 


(3) An “excluded entity” is an entity — 
(a) which is a proscribed organisation under the Terrorism Act 2000 (see 
section 3 of that Act), or 


(b) the purpose of which is to support a proscribed organisation under that 
Act. 


(4) For the purposes of subsection (2) — 

(a) news-related material is “subject to editorial control” if there is a person 
(whether or not the publisher of the material) who has editorial or 
equivalent responsibility for the material, including responsibility for 
how it is presented and the decision to publish it; 

(b) “control” has the same meaning as it has in the Broadcasting Act 1990 
by virtue of section 202 of that Act. 


(5) In this section— 
“news-related material” means material consisting of — 
(a) news or information about current affairs, 
(b) opinion about matters relating to the news or current affairs, or 
(c) gossip about celebrities, other public figures or other persons in 
the news; 

“publish” means publish by any means (including by broadcasting), and 
references to a publisher and publication are to be construed 
accordingly; 

“standards code” means — 

(a) a code of standards that regulates the conduct of publishers, 
that is published by an independent regulator, or 

(b) a code of standards that regulates the conduct of the entity in 
question, that is published by the entity itself. 


41 Meaning of “illegal content” etc 
(1) This section applies for the purposes of this Part. 


(2) “Illegal content” means — 
(a) in relation to a regulated user-to-user service, content — 
(i) that is regulated content in relation to that service, and 
(ii) that amounts to a relevant offence; 


(b) in relation to a regulated search service, content that amounts to a 
relevant offence. 
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For the purposes of this section, content consisting of certain words, images, 
speech or sounds amounts to a relevant offence if the provider of the service 
has reasonable grounds to believe that — 
(a) the use of the words, images, speech or sounds amounts to a relevant 
offence, 
(b) the use of the words, images, speech or sounds, when taken together 
with other regulated content present on the service, amounts to a 
relevant offence, or 


(c) the dissemination of the content constitutes a relevant offence. 


“Relevant offence” means — 
(a) aterrorism offence (see section 42), 
(b) a CSEA offence (see section 43), 
(c) an offence that is specified in, or is of a description specified in, 
regulations made by the Secretary of State (see section 44), or 
(d) an offence, not within paragraph (a), (b) or (c), of which the victim or 
intended victim is an individual (or individuals). 


Illegal content — 
(a) is “terrorism content” if the relevant offence is a terrorism offence; 
(b) is “CSEA content” if the relevant offence is a CSEA offence; 
(c) is “priority illegal content” if the relevant offence is an offence that is 
specified in, or is of a description specified in, regulations under 
subsection (4)(c). 


An offence is not to be regarded as a relevant offence within subsection (4)(d) 
if the offence concerns — 
(a) the infringement of intellectual property rights, 
(b) the safety or quality of goods (as opposed to what kind of goods they 
are), or 
(c) the performance of a service by a person not qualified to perform it. 


For the purposes of determining whether content amounts to an offence (or to 
an offence of a particular description), no account is to be taken of whether or 
not anything done in relation to the content takes place in any part of the 
United Kingdom. 


In relation to a regulated user-to-user service, the terms “illegal content’, 
“terrorism content”, “CSEA content” and “priority illegal content” are to be 
taken to include material which, if it were present on the service, would be 
content within the definition in question (and this section is to be read with 
such modifications as may be necessary for that purpose). 


In this section “offence” means an offence under the law of any part of the 
United Kingdom. 


Offences relating to terrorism 


In this Part “terrorism offence” means an offence specified in Schedule 2. 


The Secretary of State may by regulations amend Schedule 2. 


Offences relating to child sexual exploitation and abuse 


In this Part “CSEA offence” means an offence specified in Schedule 3. 
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(2) The Secretary of State may by regulations amend Part 1 or 3 of Schedule 3. 
(3) The Scottish Ministers may by regulations amend Part 2 of Schedule 3. 


44 Regulations under section 41 


(1) When deciding whether to specify an offence, or a description of offence, in 
regulations under section 41, the Secretary of State must take into account — 
(a) the prevalence on regulated services of content that amounts to that 
offence or (as the case may be) offences of that description, 
(b) the level of risk of harm being caused to individuals in the United 
Kingdom by the presence of such content, and 
(c) the severity of that harm. 


(2) For the purposes of subsection (1), content consisting of certain words, images, 
speech or sounds amounts to an offence or to an offence of a particular 
description if there are reasonable grounds to believe that — 

(a) the use of the words, images, speech or sounds amounts to the offence 
or to an offence of that description, 

(b) the use of the words, images, speech or sounds, when taken together 
with other regulated content present on regulated services, amounts to 
the offence or to an offence of that description, or 


(c) the dissemination of the content constitutes the offence or an offence of 
that description. 


(3) For the purposes of determining whether content amounts to an offence (or to 
an offence of a particular description), no account is to be taken of whether or 
not anything done in relation to the content takes place in any part of the 
United Kingdom. 


(4) Insubsection (1), the reference to the prevalence of content of a particular kind 
is to be read, in relation to search services, as a reference to the prevalence of 
content of that kind presented to users by operation of the search engine in 
response to search requests made by them. 


(5) The Secretary of State may not specify an offence in regulations under section 
41 if the offence concerns — 


(a) the infringement of intellectual property rights, 


(b) the safety or quality of goods (as opposed to what kind of goods they 
are), or 


(c) the performance of a service by a person not qualified to perform it. 


(6) The Secretary of State may not specify a description of offence in regulations 
under section 41 if offences of that description are offences within subsection 


(9). 


45 Meaning of “content that is harmful to children” etc 
(1) This section applies for the purposes of this Part. 


(2) “Content that is harmful to children”, in relation to a regulated service, means 
content that is — 
(a) (in the case of a user-to-user service) regulated content in relation to 
that service, and 
(b) either— 
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(i) ofa description designated in regulations made by the Secretary 
of State as primary priority content that is harmful to children 
(see section 47), 
(ii) of a description designated in such regulations as priority 
content that is harmful to children, or 
(iii) within subsection (3) or (5). 


Content is within this subsection if the provider of the service has reasonable 
grounds to believe that the nature of the content is such that there is a material 
risk of the content having, or indirectly having, a significant adverse physical 
or psychological impact on a child of ordinary sensibilities (“C”). 


For the purposes of subsection (3), in the case of content which may reasonably 
be assumed to particularly affect people with a certain characteristic (or 
combination of characteristics), or to particularly affect a certain group of 
people, the provider is to assume that C possesses that characteristic (or 
combination of characteristics), or is a member of that group (as the case may 


be). 


Content is within this subsection if the provider of the service has reasonable 
grounds to believe that there is a material risk of the fact of the content’s 
dissemination having a significant adverse physical or psychological impact 
on a child of ordinary sensibilities (“C”), taking into account (in particular) — 
(a) how many users may be assumed to encounter the content by means of 
the service, and 
(b) how easily, quickly and widely content may be disseminated by means 
of the service. 


For the purposes of subsections (3) and (5), the provider is to assess impact on 
C by reference to children across the age-range, and the content is to be 
regarded as within subsection (3) or (5) (as the case may be) if the provider has 
reasonable grounds to believe that there is a material risk of impact as 
mentioned in the relevant subsection on a child of any particular age. 


Where the provider has knowledge, relevant to the content, about a particular 
child at whom content is directed, or who is the subject of it, subsections (3) and 
(5) are to be read as if the reference to a child of ordinary sensibilities were a 
reference to that particular child, taking into account any of the following 
things that are known to or inferred by the provider — 

(a) that child’s characteristics; 

(b) that child’s membership of a certain group of people. 


The reference in subsection (3) to a risk of content “indirectly” having a 
significant adverse physical or psychological impact on a child is a reference to 
a risk of either of the following — 

(a) content causing an individual to do or say things to a targeted child that 
would have a significant adverse physical or psychological impact on 
such a child; 

(b) content causing a child to act in a way that— 

(i) has a significant adverse physical or psychological impact on 
that child, or 


(ii) increases the likelihood of such an impact on that child. 


For the purposes of this section— 


(a) illegal content (see section 41) is not to be regarded as within subsection 
(3) or (5), and 
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(b) content is not to be regarded as within subsection (3) or (5) if the risk of 
physical or psychological impact flows from — 
(i) the content’s potential financial impact, 
(ii) the safety or quality of goods featured in the content, or 
(iii) the way in which a service featured in the content may be 
performed (for example, in the case of the performance of a 
service by a person not qualified to perform it). 


(10) In this Part— 


“non-designated content that is harmful to children” means content that 
is harmful to children but that is not— 


(a) primary priority content that is harmful to children, or 
(b) priority content that is harmful to children; 
“primary priority content that is harmful to children” means content of a 
description designated as such in regulations under subsection (2)(b); 


“priority content that is harmful to children” means content of a 
description designated as such in regulations under subsection (2)(b). 


(11) In relation to a regulated user-to-user service, the terms “content that is 
harmful to children”, “primary priority content that is harmful to children”, 
“priority content that is harmful to children” and “non-designated content that 
is harmful to children” are to be taken to include material which, if it were 
present on the service, would be content within the definition in question (and 
this section is to be read with such modifications as may be necessary for that 
purpose). 


(12) In this section “targeted child”, in relation to content, means a child — 
(a) who is the subject of the content, or 
(b) who is a member of a class or group of people with a certain 
characteristic (or combination of characteristics) targeted by the 
content. 


46 Meaning of “content that is harmful to adults” etc 
(1) This section applies for the purposes of this Part. 


(2) “Content that is harmful to adults”, in relation to a Category 1 service, means 
content that is — 
(a) regulated content in relation to that service, and 
(b) either— 
(i) ofa description designated in regulations made by the Secretary 
of State as priority content that is harmful to adults (see section 
47), or 
(ii) within subsection (3) or (5). 


(3) Content is within this subsection if the provider of the service has reasonable 
grounds to believe that the nature of the content is such that there is a material 
risk of the content having, or indirectly having, a significant adverse physical 
or psychological impact on an adult of ordinary sensibilities (“A”). 


(4) For the purposes of subsection (3), in the case of content which may reasonably 
be assumed to particularly affect people with a certain characteristic (or 
combination of characteristics), or to particularly affect a certain group of 
people, the provider is to assume that A possesses that characteristic (or 
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combination of characteristics), or is a member of that group (as the case may 


be). 


(5) Content is within this subsection if the provider of the service has reasonable 
grounds to believe that there is a material risk of the fact of the content’s 
dissemination having a significant adverse physical or psychological impact 
on an adult of ordinary sensibilities, taking into account (in particular) — 

(a) how many users may be assumed to encounter the content by means of 
the service, and 

(b) how easily, quickly and widely content may be disseminated by means 
of the service. 


(6) Where the provider has knowledge, relevant to the content, about a particular 
adult at whom content is directed, or who is the subject of it, subsections (3) 
and (5) are to be read as if the reference to an adult of ordinary sensibilities 
were a reference to that particular adult, taking into account any of the 
following things that are known to or inferred by the provider — 

(a) that adult’s characteristics; 
(b) that adult’s membership of a certain group of people. 


(7) The reference in subsection (3) to a risk of content “indirectly” having a 
significant adverse physical or psychological impact on an adult is a reference 
to a risk of either of the following — 


(a) content causing an individual to do or say things to a targeted adult 
that would have a significant adverse physical or psychological impact 
on such an adult; 

(b) content causing an adult to act ina way that— 

(i) has a significant adverse physical or psychological impact on 
that adult, or 
(ii) increases the likelihood of such an impact on that adult. 


(8) For the purposes of this section— 
(a) illegal content (see section 41) is not to be regarded as within subsection 
(3) or (5), and 
(b) content is not to be regarded as within subsection (3) or (5) if the risk of 
physical or psychological impact flows from — 
(i) the content’s potential financial impact, 
(ii) the safety or quality of goods featured in the content, or 
(iii) the way in which a service featured in the content may be 
performed (for example, in the case of the performance of a 
service by a person not qualified to perform it). 


(9) “Priority content that is harmful to adults” means content of a description 
designated as such in regulations under subsection (2)(b). 


(10) Inrelation to a Category 1 service, the terms “content that is harmful to adults” 
and “priority content that is harmful to adults” are to be taken to include 
material which, if it were present on the service, would be content within the 
definition in question (and this section is to be read with such modifications as 
may be necessary for that purpose). 


(11) In this section “targeted adult”, in relation to content, means an adult — 
(a) who is the subject of the content, or 
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(b) who is a member of a class or group of people with a certain 
characteristic (or combination of characteristics) targeted by the 
content. 


Regulations under sections 45 and 46 


In this section “regulations” means — 

(a) regulations under section 45 (designation of descriptions of content as 
primary priority content that is harmful to children or priority content 
that is harmful to children), or 

(b) regulations under section 46 (designation of descriptions of content as 
priority content that is harmful to adults). 


The Secretary of State must consult OFCOM before making regulations. 


For so long as regulations are in force, OFCOM must carry out reviews of — 
(a) the incidence on regulated services of content that is harmful to 
children and content that is harmful to adults, and 
(b) the severity of harm that individuals in the United Kingdom suffer, or 
may suffer, as a result of those kinds of content. 


OFCOM must prepare and publish a report on the outcome of each review. 


The report must contain — 
(a) OFCOM’s conclusions about whether provision made by the 
regulations remains appropriate, and 
(b) in consequence of those conclusions, OFCOM’s recommendations in 
relation to the exercise of the Secretary of State’s power to make 
regulations. 


The reports must be published not more than three years apart. 


The first report must be published before the end of the period of three years 
beginning with the day on which the first statutory instrument containing 
regulations is made. 


On completion of each report, OFCOM must, as soon as reasonably 
practicable — 
(a) send it to the Secretary of State, and 
(b) publish it in such manner as OFCOM consider appropriate for bringing 
it to the attention of persons who, in their opinion, are likely to be 
affected by it. 


In subsection (3)(a), the reference to the incidence of content of a particular 
kind is to be read, in relation to search services, as a reference to content of that 
kind presented to users by operation of the search engine in response to search 
requests made by them. 


Meaning of “Chapter 2 safety duty” and “Chapter 3 safety duty” 


In this Part “Chapter 2 safety duty” means any of the duties set out in— 
(a) section 9 (safety duties about illegal content), 
(b) section 10 (safety duties for services likely to be accessed by children), 
or 
(c) section 11 (safety duties protecting adults). 
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(2) In this Part “Chapter 3 safety duty” means any of the duties set out in — 
(a) section 21 (safety duties about illegal content), or 
(b) section 22 (safety duties for services likely to be accessed by children). 


PART 3 
OTHER DUTIES OF SERVICE PROVIDERS 
CHAPTER 1 


TRANSPARENCY REPORTS 


49 Transparency reports by service providers 


(1) A provider of a relevant service must, in relation to each relevant service 
provided, produce an annual report under this section (a “transparency 
report”), which must — 


(a) contain information of a kind described by OFCOM in a notice given to 
the provider, 


(b) bein the format specified in the notice, 
(c) be submitted to OFCOM by the date specified in the notice, and 
(d) be published in the manner and by the date specified in the notice. 


(2) A provider must ensure that the information provided in a transparency report 
is— 
(a) complete, and 
(b) accurate in all material respects. 


(3) A “relevant service” means — 
(a) a Category 1 service (see section 59(6)(a)); 
(b) a Category 2A service (see section 59(6)(b)); 
(c) a Category 2B service (see section 59(6)(c)). 


(4) OFCOM may only describe information of the following kinds in a notice 
under subsection (1) — 

(a) information about the incidence of illegal content, content that is 
harmful to children and content that is harmful to adults on a user-to- 
user service or in search results (as the case may be), and about how 
many users are assumed to have encountered this by means of the 
service; 

(b) information about how such content is disseminated by means of a 
service; 

(c) information about— 

(i) inthe case of a user-to-user service, how the terms of service are 
applied; 

(ii) in the case of a search service, how the statements of policies 
and procedures mentioned in sections 21(4) and 22(4) are 
applied; 

(d) information about the systems and processes for users to report — 

(i) in the case of a user-to-user service, content present on the 
service which is considered to be illegal content, content that is 
harmful to children or content that is harmful to adults, or other 
content which is considered to breach the terms of service; 
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(ii) in the case of a search service, content encountered in or via 
search results which is considered to be illegal content or 
content that is harmful to children, or other content which is 
considered to breach any statements of policies or procedures 
relating to the service which have been made publicly available 
by the provider of the service; 

information about systems and processes which a provider uses to deal 
with illegal content, content that is harmful to children and content that 
is harmful to adults, including systems and processes for identifying 
such content, and — 

(i) in the case of a user-to-user service, taking down such content; 

(ii) in the case of a search service, minimising the risk of illegal 
content or content that is harmful to children being encountered 
in or via search results; 

information about functionalities to help users manage risks relating to 
content that is harmful to children and content that is harmful to adults; 
information about steps that a provider is taking to comply with any 
duty set out in Part 2 (including in particular steps that are described in 
a code of practice under section 29); 

information about ways in which a provider co-operates with 
government, regulatory or other public sector bodies in the United 
Kingdom, in particular those involved in the enforcement of the 
criminal law; 

information about systems and processes by which a provider assesses 
the risk of harm to individuals from the presence of illegal content, 
content that is harmful to children or content that is harmful to adults 
on a user-to-user service or in search results (as the case may be) — 

(i) when a service is initially being designed or developed, 

(ii) when any further development or update to a service is being 
considered, and 

(iii) while a service is in operation; 
information about systems and processes a provider has in place — 

(i) to direct users of a service to information about how they can 
protect themselves from harm in relation to illegal content, 
content that is harmful to children and content that is harmful 
to adults, and 

(ii) to counteract or provide support to users of a service in relation 
to illegal content, content that is harmful to children or content 
that is harmful to adults present on a user-to-user service or 
encountered in or via search results (as the case may be); 

information about steps that a provider is taking to provide a higher 
standard of protection for children than for adults; 

information about steps that a provider is taking to improve the media 
literacy of users of a service, and an evaluation of the effectiveness of 
such steps; 

information about any other steps that a provider is taking which relate 
to online safety matters. 


(5) When determining which information to require in a notice under subsection 
(1) in relation to a particular service, OFCOM must take into account — 


(a) 


the kinds of content in relation to which the provider of the service has 
duties under Chapter 2 or 3 of Part 2 (as the case may be); 
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(b) the capacity of the provider of the service to produce information; 
(c) the kind of service it is; 

(d) the functionalities of the service; 

(e) the number of users of the service; 

(f) the proportion of users of the service who are children. 


(6) The Secretary of State may by regulations amend subsection (1) so as to change 
the frequency with which a transparency report must be produced. 


(7) The Secretary of State may by regulations — 
(a) amend subsection (4) so as to add further descriptions of information, 
or to vary or omit descriptions of information, and 
(b) amend subsection (5) in connection with any such amendment. 


(8) The Secretary of State must consult OFCOM before making regulations under 
subsection (6) or (7). 
(9) In this section— 
“content that is harmful to adults” has the meaning given by section 46; 
“content that is harmful to children” has the meaning given by section 45; 
“illegal content” has the meaning given by section 41; 
“users” means United Kingdom users (see section 122). 


50 Transparency reports: guidance 


(1) OFCOM must prepare guidance on the following matters — 

(a) how OFCOM will determine which descriptions of information in 
section 49(4) they will require a transparency report under that section 
relating to a particular kind of relevant service, or a relevant service 
provided by a particular kind of provider, to contain, including — 

(i) the principles that OFCOM will apply in relation to each of the 
factors mentioned in section 49(5), and 

(ii) the steps that OFCOM will take to engage with providers of 
relevant services before requiring descriptions of information in 
a notice under section 49(1) in relation to a relevant service 
provided by them; 

(b) how information from transparency reports produced by providers of 
relevant services under section 49 will be used to produce OFCOM’s 
transparency reports (see section 100); and 

(c) any other matter that OFCOM consider to be relevant to the production 
and publication of transparency reports under section 49 or 100. 


(2) Before preparing guidance under this section (including revised or 
replacement guidance), OFCOM must consult such of the following as they 
consider appropriate — 

(a) providers of regulated user-to-user services, and of regulated search 
services, 
(b) persons who appear to OFCOM to represent such providers, 
(c) persons whom OFCOM consider to have expertise in equality issues 
and human rights, in particular — 
(i) the right to freedom of expression set out in Article 10 of the 
Convention, and 
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(ii) the right to respect for a person’s private and family life, home 
and correspondence set out in Article 8 of the Convention, 
(d) persons who appear to OFCOM to represent the interests of children, 
(e) persons who appear to OFCOM to represent the interests of those with 
protected characteristics (within the meaning of Part 2 of the Equality 
Act 2010), 
(f) persons whom OFCOM consider to have expertise in online safety 
matters, and 
(g) persons whom OFCOM consider to have expertise, relevant to online 
safety matters, in the enforcement of the criminal law and the 
protection of national security, 
and OFCOM must also consult any other person whom OFCOM consider 
appropriate. 


3) OFCOM must publish the guidance (and any revised or replacement 
P 8 y pP 
guidance). 


(4) Inexercising their functions under section 49 or 100, OFCOM must have regard 
to the guidance for the time being in force under this section. 


(5) In this section, “relevant service” has the same meaning as in section 49 (see 
subsection (3) of that section). 


CHAPTER 2 


FEES 


51 Duty to notify OFCOM 


(1) A provider of a regulated service must notify OFCOM in relation to a charging 
year which is — 
(a) the first fee-paying year in relation to that provider, or 
(b) any charging year after the first fee-paying year where — 

(i) the previous charging year was not a fee-paying year in relation 
to the provider, and the charging year in question is a fee- 
paying year in relation to the provider, or 

(ii) the previous charging year was a fee-paying year in relation to 
the provider, and the charging year in question is not a fee- 
paying year in relation to the provider. 


(2) A “fee-paying year”, in relation to a provider, means a charging year where 
both of the following conditions apply — 

(a) the provider’s qualifying worldwide revenue for the qualifying period 
that relates to that charging year is equal to or greater than the 
threshold figure for the time being published in accordance with 
section 53, and 

(b) the provider is not exempt (see subsection (5)). 


(3) A notification under subsection (1) in relation to a charging year must include 
details of all regulated services provided by the provider, and where it is a 
notification under subsection (1)(a) or (b)(i), it must also include — 

(a) details of the provider’s qualifying worldwide revenue for the 
qualifying period that relates to that charging year, and 
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(b) any supporting evidence, documents or other information specified by 
OFCOM in a statement of principles as mentioned in section 55(1). 


(4) A notification under subsection (1) must be provided to OFCOM by the time 
specified by OFCOM ina statement of principles as mentioned in section 55(1). 


5) OFCOM may provide that particular descriptions of providers of regulated 
y P P P P 8 
services are exempt for the purposes of this section and section 52 where — 
(a) OFCOM consider that an exemption for such providers is appropriate, 
and 
(b) the Secretary of State approves the exemption. 


(6) OFCOM may revoke such an exemption where they consider that it is no 
longer appropriate and the Secretary of State approves the revocation. 


(7) OFCOM must publish details of any exemption for the time being approved 
under subsection (5). 


(8) In this section, “qualifying worldwide revenue” and “qualifying period” have 
the meaning given to them by regulations made by the Secretary of State. 


(9) The Secretary of State must consult OFCOM before making regulations under 
subsection (8). 


(10) For the purposes of this section and section 52, the “provider” of a regulated 
service, in relation to a charging year, includes a person who is the provider of 
the service for part of that year. 


(11) In this section— 
“charging year” means any period of 12 months beginning with 1 April, 
except such a period that falls before the initial charging year; 
“initial charging year” means the period of 12 months beginning with 1 
April specified by OFCOM in a notice published for the purposes of 
this section and section 53. 


52 Duty to pay fees 


(1) OFCOM may require a provider of a regulated service to pay a fee in respect 
of a charging year which is a fee-paying year. 


(2) Where OFCOM require a provider of a regulated service to pay a fee in respect 
of a charging year, the fee is to be equal to the amount produced by a 
computation — 

(a) made by reference to— 
(i) the provider’s qualifying worldwide revenue for the qualifying 
period relating to that charging year, and 
(ii) any other factors that OFCOM consider appropriate, and 
(b) made in the manner that OFCOM consider appropriate. 


(3) For the purposes of this section and section 51 — 
(a) the amount of a provider’s qualifying worldwide revenue for a 
qualifying period, or 
(b) the amount of a fee to be paid to OFCOM, or of an instalment of sucha 
fee, 


is, in the event of a disagreement between the provider and OFCOM, the 
amount determined by OFCOM. 
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(4) When determining fees payable under this section, OFCOM must do so in 
accordance with a statement of principles as mentioned in section 55(1). 


(5) Where a person is the provider of a regulated service for part of a charging year 
only, OFCOM may refund all or part of a fee paid to OFCOM under this section 
by that provider in respect of that year. 


(6) In this section, the following expressions have the same meaning as in section 
51— 
“charging year”; 
“fee-paying year”; 
“qualifying period”; 
“qualifying worldwide revenue”. 


53 Threshold figure 


(1) OFCOM must determine the figure that they consider appropriate to be the 
threshold figure for the purposes of sections 51 and 52 (“OFCOM’s proposed 
figure”). 


(2) OFCOM must notify the Secretary of State of OFCOM’s proposed figure. 


3) If the Secretary of State approves OFCOM’s proposed figure — 
X PP prop 8 
(a) the Secretary of State must notify OFCOM of this, and 
(b) OFCOM must publish this figure as the threshold figure. 


4) Ifthe Secretary of State does not approve OFCOM’s proposed figure — 
y pp prop 8 
(a) the Secretary of State must notify OFCOM of this, 


(b) the Secretary of State must determine the figure that the Secretary of 
State considers appropriate to be the threshold figure for the purposes 
of sections 51 and 52, and 


(c) the Secretary of State must publish that figure as the threshold figure. 


(5) OFCOM must keep the threshold figure under review, and where OFCOM 
consider that this figure should be amended, subsections (1) to (4) apply again. 


(6) The first threshold figure must be published before the start of the initial 
charging year. 


(7) In this section, “initial charging year” has the same meaning as in section 51. 


54 Secretary of State’s guidance 


(1) The Secretary of State must issue guidance to OFCOM — 
(a) about the principles to be included in a statement of principles that 
OFCOM propose to apply in determining fees payable under section 52 
(see section 55), and 
(b) setting out principles to be considered when determining the threshold 
figure under section 53. 


(2) The Secretary of State must consult OFCOM before issuing, revising or 
replacing the guidance. 


(3) The guidance may not be revised or replaced more frequently than once every 
three years unless — 
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(a) the guidance needs to be corrected because of an amendment, repeal or 
modification of any provision of this Chapter, or 

(b) the revision or replacement is by agreement between the Secretary of 
State and OFCOM. 


The Secretary of State must lay the guidance (including revised or replacement 
guidance) before Parliament. 


The Secretary of State must publish the guidance (and any revised or 
replacement guidance). 


OFCOM must have regard to the guidance when exercising functions under 
this Chapter. 


Fees statements by OFCOM 


OFCOM may not require a provider of a regulated service to pay a fee under 
section 52 unless there is in force a statement of the principles that OFCOM 
propose to apply in determining fees payable under that section. 


Those principles must be such as appear to OFCOM to be likely to secure, on 
the basis of such estimates of the likely costs as it is practicable for them to 
make — 

(a) that ona year by year basis, the aggregate amount of the fees payable 
to OFCOM under section 52 is sufficient to meet, but does not exceed, 
the annual cost to OFCOM of the exercise of their online safety 
functions; 

(b) that the amount of any fee required under section 52 is justifiable and 
proportionate having regard to the provider who will be required to 
pay it and the functions in respect of which it is imposed; 

(c) that the relationship between meeting the cost of the exercise of those 
functions and the amounts of the fees is transparent. 


A statement of principles mentioned in subsection (1) must include details 
relating to the computation model used to calculate fees payable under section 
52, including details of factors mentioned in subsection (2)(a)(ii) of that section 
(if any). 


Before making or revising such a statement of principles, OFCOM must 
consult such of the persons who, in OFCOM’s opinion, are likely to be affected 
by those principles as they think fit. 


The way in which such a statement of principles must be made or may be 
revised is by the publication of the statement or revised statement in such 
manner as OFCOM consider appropriate for bringing it to the attention of 
persons who, in their opinion, are likely to be affected by it. 


As soon as reasonably practicable after the end of each charging year, OFCOM 
must publish a statement setting out, in respect of that year — 


(a) the aggregate amounts of the fees payable under section 52 for that year 
that have been received by OFCOM, 

(b) the aggregate amounts of the fees payable under that section for that 
year that remain outstanding and are likely to be paid or recovered, and 

(c) the cost to OFCOM of the exercise of their online safety functions. 


Any deficit or surplus shown (after applying this subsection for all previous 
years) by a statement under subsection (6) must be carried forward and taken 
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into account in determining what is required to satisfy the requirement 
imposed by virtue of subsection (2)(a) in relation to the following year. 


(8) For the purposes of this section— 

(a) OFCOM’s costs of the exercise of their online safety functions during a 
charging year include the costs of preparations for the exercise of their 
online safety functions incurred during that year; and 

(b) OFCOM’s costs of preparations for the exercise of their online safety 
functions incurred after the day on which this section comes into force 
but before the charging year in which those functions were first 
exercised are to be treated as if they were incurred during that year. 


(9) In this section, “charging year” has the same meaning as in section 51. 
PART 4 
OFCOM'S POWERS AND DUTIES IN RELATION TO REGULATED SERVICES 
CHAPTER 1 


GENERAL DUTIES 


56 General duties of OFCOM under section 3 of the Communications Act 


(1) Section 3 of the Communications Act (general duties of OFCOM) is amended 
in accordance with subsections (2) to (8). 


(2) In subsection (2), after paragraph (f) insert— 

“(g) the adequate protection of citizens from harm arising from 
regulated services through the appropriate use by providers of 
such services of systems and processes designed to reduce the 
risk of such harm.” 


(3) In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”. 
(4) After subsection (4) insert — 


“(4A) In performing their duties under subsection (1) in relation to matters to 
which subsection (2)(g) is relevant, OFCOM must have regard to such 
of the following as appear to them to be relevant in the circumstances — 

(a) the risk of harm to citizens arising from (in the case of user-to- 
user services) content present on such services or (in the case of 
search services) content that may be encountered in or via 
search results; 

(b) the need for a higher level of protection for children than for 
adults; 

(c) the need for it to be clear to providers of regulated services how 
they may comply with their duties under Chapter 2, 3 or 4 of 
Part 2 of the Online Safety Act 2021 (duties of care); 

(d) the need to exercise their functions so as to secure that providers 
of regulated services may comply with such duties by taking 
steps which are proportionate to— 

(i) the kind, size or capacity of the provider in question, 
and 
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(ii) the level of risk of harm presented by the service in 
question, and the severity of the potential harm; 


(e) the desirability of promoting the use by providers of regulated 
services of technologies designed to reduce the risk of harm 
arising to citizens from (in the case of user-to-user services) 
content present on such services or (in the case of search 
services) content that may be encountered in or via search 
results; 


(f) the extent to which providers of regulated services 
demonstrate, in a way that is transparent and accountable, that 
they are complying with their duties under Chapter 2, 3 or 4 of 
Part 2 of the Online Safety Act 2021 (as the case may be).” 


(5) After subsection (5) insert — 


“(5A) Subsection (4)(c) does not apply in relation to the carrying out of any of 
OFCOM’s online safety functions.” 


(6) After subsection (6) insert — 


“(6ZA) Where it appears to OFCOM, in relation to the carrying out of any of 
their online safety functions, that any of their general duties conflict 
with their duty under section 24, priority must be given to their duty 
under that section.” 


(7) In subsection (14), at the appropriate place insert — 


““online safety functions” has the meaning given by section 136 of 
the Online Safety Act 2021, except that it does not include 
OFCOM’s general duties;”. 


(8) After subsection (14) insert — 


“(15) In this section the following terms have the same meaning as in the 
Online Safety Act 2021 — 


“content” (see section 137 of that Act); 
“harm” (see section 137 of that Act); 


“provider”, in relation to a regulated service (see section 116 of 
that Act); 

“regulated service” (see section 3 of that Act); 

“search results” and “via search results” (see section 134 of that 
Act); 

“search service” (see section 2 of that Act); 

“user-to-user service” (see section 2 of that Act).” 


(9) In section 6 of the Communications Act (duties to review regulatory 
burdens) — 


(a) in subsection (2), after “this section” insert “(except their online safety 
functions)”, and 


(b) after subsection (10) insert — 


“(11) In this section “online safety functions” has the same meaning 
as in section 3.” 
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58 
(1) 


(2) 
(3) 


Duties of OFCOM in relation to strategic priorities 


This section applies where a statement has been designated under section 
109(1) (Secretary of State’s statement of strategic priorities). 


OFCOM must have regard to the statement when carrying out their online 
safety functions. 


OFCOM must within the period of 40 days beginning with the day on which 
the statement is designated, or such longer period as the Secretary of State may 
allow — 
(a) explain in writing what they propose to do in consequence of the 
statement, and 
(b) publish a copy of that explanation in such manner as OFCOM consider 
appropriate. 


OFCOM must, as soon as practicable after the end of — 
(a) the period of 12 months beginning with the day on which the first 
statement is designated under section 109(1), and 
(b) every subsequent period of 12 months, 
publish a review of what they have done during the period in question in 
consequence of the statement. 


Duty to carry out impact assessments 


Section 7 of the Communications Act (duty to carry out impact assessments) is 
amended as follows. 


In subsection (2), at the beginning insert “Subject to subsection (2A),”. 
After subsection (2) insert — 


“(2A) A proposal to do any of the following is important for the purposes of 
this section — 
(a) to prepare a code of practice under section 29 of the Online 
Safety Act 2021; 
(b) to prepare amendments of such a code of practice; or 
(c) to prepare a code of practice as a replacement for such a code of 
practice.” 


After subsection (4) insert — 


“(4A) An assessment under subsection (3)(a) that relates to a proposal 
mentioned in subsection (2A) must include an assessment of the likely 
impact of implementing the proposal on small businesses and micro 
businesses. 


(4B) An assessment under subsection (3)(a) that relates to a proposal to do 
anything else for the purposes of, or in connection with, the carrying 
out of OFCOM’s online safety functions (within the meaning of section 
136 of the Online Safety Act 2021), must, so far as the proposal relates 
to such functions, include an assessment of the likely impact of 
implementing the proposal on small businesses and micro businesses.” 
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CHAPTER 2 


REGISTER OF CATEGORIES OF SERVICES 


Register of categories of services 


As soon as reasonably practicable after the first regulations under Schedule 4 
come into force, OFCOM must — 

(a) establish a register of particular categories of regulated services with — 

(i) one part for user-to-user services meeting the Category 1 
threshold conditions, 
(ii) one part for search services meeting the Category 2A threshold 
conditions, and 
(iii) one part for user-to-user services meeting the Category 2B 
threshold conditions; 

(b) inrelation to each regulated user-to-user service which they consider is 
likely to meet the Category 1 threshold conditions, assess whether the 
service does, or does not, meet those conditions; 

(c) inrelation to each regulated search service which they consider is likely 
to meet the Category 2A threshold conditions, assess whether the 
service does, or does not, meet those conditions; 

(d) inrelation to each regulated user-to-user service which they consider is 
likely to meet the Category 2B threshold conditions, assess whether the 
service does, or does not, meet those conditions; and 


(e) where they consider that a service meets the relevant threshold 
conditions, add entries relating to that service to the relevant part of the 
register. 


Each part of the register must contain — 

(a) the name, and a description, of each regulated service that, in 
OFCOM’s opinion, meets the relevant threshold conditions as 
provided for by regulations under Schedule 4, and 

(b) the name of the provider of each such service. 


If OFCOM consider that a regulated user-to-user service meets the Category 1 
threshold conditions and the Category 2B threshold conditions, entries relating 
to that service are to be added to the part of the register established under 
subsection (1)(a)(i) (only). 


When assessing whether a regulated service does, or does not, meet the 
relevant threshold conditions, OFCOM must take such steps as are reasonably 
practicable to obtain or generate information or evidence for the purposes of 
the assessment. 


OFCOM must publish the register in such manner as they consider appropriate 
for bringing it to the attention of persons who, in their opinion, are likely to be 
affected by it. 


In this Act — 
(a) a “Category 1 service” means a regulated user-to-user service for the 
time being included in the part of the register established by OFCOM 
under subsection (1)(a)(i); 
(b) a “Category 2A service” means a regulated search service for the time 
being included in the part of the register established by OFCOM under 
subsection (1)(a) (ii); 
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60 
(1) 


(c) a“Category 2B service” means a regulated user-to-user service for the 
time being included in the part of the register established by OFCOM 
under subsection (1)(a)(iii). 


Schedule 4 contains provision about regulations specifying the threshold 
conditions that a service must meet to be included in the relevant part of the 
register, and associated provision about the publication of OFCOM’s advice. 


In this section, “Category 1 threshold conditions”, “Category 2A threshold 
conditions” and “Category 2B threshold conditions” have the same meaning as 
in Schedule 4 (see paragraph 1(1), (2) and (3) of that Schedule). 


OFCOM’s duty to maintain register 


If regulations are made under paragraph 1(1) of Schedule 4 which amend or 
replace regulations previously made under that provision, OFCOM must, as 
soon as reasonably practicable after the date on which the amending or 
replacement regulations are made — 

(a) in relation to each regulated user-to-user service which they consider is 
likely to meet the new Category 1 threshold conditions, assess whether 
the service does, or does not, meet those conditions, and 

(b) make any necessary changes to the register. 


If regulations are made under paragraph 1(2) of Schedule 4 which amend or 
replace regulations previously made under that provision, OFCOM must, as 
soon as reasonably practicable after the date on which the amending or 
replacement regulations are made — 
(a) inrelation to each regulated search service which they consider is likely 
to meet the new Category 2A threshold conditions, assess whether the 
service does, or does not, meet those conditions, and 


(b) make any necessary changes to the register. 


If regulations are made under paragraph 1(3) of Schedule 4 which amend or 
replace regulations previously made under that provision, OFCOM must, as 
soon as reasonably practicable after the date on which the amending or 
replacement regulations are made — 
(a) in relation to each regulated user-to-user service which they consider is 
likely to meet the new Category 2B threshold conditions, assess 
whether the service does, or does not, meet those conditions, and 


(b) make any necessary changes to the register. 


At any other time, if OFCOM consider that a regulated service not included in 
a particular part of the register is likely to meet the threshold conditions 
relevant to that part, OFCOM must — 
(a) assess the service accordingly, and 
(b) (subject to section 59(3)) if they consider that the service meets the 
relevant conditions, add entries relating to that service to that part of 
the register. 


A provider of a regulated service included in the register may at any time 
request OFCOM to remove entries relating to that service from the register, or 
from a particular part of the register. 


If OFCOM are satisfied, on the basis of evidence submitted by a provider with 
such a request, that since the registration day there has been a change to the 
service which appears likely to be relevant, OFCOM must — 
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(a) assess the service, and 
(b) notify the provider of OFCOM’s decision. 


(7) OFCOM must remove entries relating to a regulated service from the relevant 
part of the register if, following an assessment of the service, they consider that 
it no longer meets the threshold conditions relevant to that part. 


(8) Section 59(4) applies in relation to an assessment under this section as it applies 
to an assessment under section 59. 


(9) OFCOM must re-publish the register each time a change is made to it. 


(10) See section 104 for provision about appeals against a decision to include a 
service in the register (or in a particular part of the register), or not to remove 
a service from the register (or from a particular part of the register). 


(11) In this section— 
“the register” means the register established under section 59; 
“the registration day”, in relation to a regulated service, means — 
(a) the day on which entries relating to the service were added to 
the register, or to the particular part of the register in question, 
or 


(b) if later, the day on which OFCOM last completed an assessment 
of the service under subsection (1), (2), (3) or (6). 


(12) In this section, “Category 1 threshold conditions”, “Category 2A threshold 
conditions” and “Category 2B threshold conditions” have the same meaning as 
in Schedule 4 (see paragraph 1(1), (2) and (3) of that Schedule). 


CHAPTER 3 


RISK ASSESSMENTS 


61 Risk assessments by OFCOM 


(1) OFCOM must carry out a risk assessment to identify, assess and understand 
the risks of harm to individuals presented by regulated services. 


(2) The risk assessment must, amongst other things — 
(a) assess the levels of risk of harm presented by regulated services of 
different kinds, including by giving separate consideration to— 
(i) the risk of harm to individuals in the United Kingdom 
presented by illegal content, 

(ii) the risk of harm to children in the United Kingdom, in different 
age groups, presented by content that is harmful to children, 
and 

(iii) the risk of harm to adults in the United Kingdom presented by 
content that is harmful to adults; 
(b) identify characteristics of different kinds of regulated services that are 
relevant to such risks of harm, and assess the impact of those kinds of 
characteristics on such risks. 


(3) OFCOM must develop risk profiles for different kinds of regulated services, 
categorising the services as OFCOM consider appropriate, taking into 
account — 
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(a) the characteristics of the services, and 
(b) the risk levels and other matters identified in the risk assessment. 


(4) As soon as reasonably practicable after completing a risk assessment, OFCOM 
must publish a report on the findings. 


(5) OFCOM must ensure that the risk assessment is kept up to date. 


(6) Inthis section the “characteristics” of a service include the functionalities of the 
service, its user base, business model, governance and other systems and 
processes. 


(7) In this section — 
“content that is harmful to adults” has the meaning given by section 46; 
“content that is harmful to children” has the meaning given by section 45; 
“illegal content” has the meaning given by section 41. 


62 OFCOM’s guidance about risk assessments 


(1) As soon as reasonably practicable after OFCOM have completed their first risk 
assessment under section 61, OFCOM must prepare guidance for providers of 
regulated services to assist them in complying with their duties to carry out 
risk assessments under section 7 or 19. 


(2) The guidance must include the risk profiles prepared under section 61 (see 
subsection (3) of that section). 


(3) OFCOM must keep the guidance up to date. 


(4) OFCOM must publish the guidance (and any revised or replacement 
guidance). 


CHAPTER 4 


USE OF TECHNOLOGY IN RELATION TO TERRORISM CONTENT AND CHILD SEXUAL 
EXPLOITATION AND ABUSE CONTENT 


63 Use of technology warning notice 


(1) OFCOM may, in accordance with this section, give a notice (a “use of 
technology warning notice”) to a provider of a regulated service stating that 
OFCOM intend to give the provider a use of technology notice under — 

(a) inthe case of a user-to-user service, section 64; 
(b) inthe case of a search service, section 65. 


(2) OFCOM may give a use of technology warning notice relating to a regulated 
user-to-user service to the provider of the service if they consider that there are 
reasonable grounds for believing that the provider is failing to comply with the 
duty in section 9 (safety duties about illegal content), so far as relating to 
terrorism content or CSEA content (or both those kinds of content), based on 
evidence demonstrating — 

(a) the prevalence, and 
(b) the persistent presence, 


of terrorism content or CSEA content or both (as the case may be) on the service 
in question. 
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(3) OFCOM may give a use of technology warning notice relating to a regulated 
search service to the provider of the service if they consider that there are 
reasonable grounds for believing that the provider is failing to comply with the 
duty in section 21 (safety duties about illegal content), so far as relating to 
terrorism content or CSEA content (or both those kinds of content), based on 
evidence demonstrating — 

(a) the prevalence, and 

(b) the persistent presence, 
of terrorism content or CSEA content or both (as the case may be) in search 
results of the service in question. 


(4) A use of technology warning notice given to a provider must — 

(a) give OFCOM’s reasons for their opinion that the provider is failing to 
comply with the duty referred to in subsection (2) or (3) (as the case 
may be), 

(b) contain details of the technology that OFCOM are considering 
requiring the provider to use, 

(c) specify whether the technology is to be required in relation to terrorism 
content or CSEA content (or both), 

(d) specify any other requirements that OFCOM are considering imposing 
(see section 64(6) and (7) or section 65(6) and (7)), and 

(e) specify the period for which OFCOM are considering imposing the 
requirements (see section 66(2)). 


(5) A use of technology warning notice given to a provider must — 
(a) state that the provider may make written representations (with any 
supporting evidence) about the matters contained in the notice, and 
(b) specify the period within which such representations may be made. 


(6) A use of technology warning notice may be given in respect of any period 
during which the failure to comply with the duty referred to in subsection (2) 
or (3) has continued, and must specify that period. 


64 Use of technology notice: user-to-user service 


(1) This section applies if — 

(a) a use of technology warning notice under section 63 relating to a 
particular regulated user-to-user service has been given to the provider 
of that service, and 

(b) the period allowed for representations has expired. 


(2) If, after considering any representations and evidence, OFCOM decide not to 
give a use of technology notice to the provider, they must inform the provider 
of that fact. 


(3) If the conditions mentioned in subsection (5) are met, OFCOM may give the 
provider a use of technology notice under this section. 


(4) A use of technology notice under this section is a notice relating to a regulated 
user-to-user service requiring the provider of the service to do either or both of 
the following — 

(a) use accredited technology to identify public terrorism content present 
on the service and to swiftly take down that content (either by means of 
the technology alone or by means of the technology together with the 
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(5) 


(9) 


65 
(1) 


use of human moderators to review terrorism content identified by the 
technology); 

(b) use accredited technology to identify CSEA content present on any part 
of the service (public or private), and to swiftly take down that content 
(either by means of the technology alone or by means of the technology 
together with the use of human moderators to review CSEA content 
identified by the technology). 


The conditions which must be met in relation to the service are as follows — 

(a) OFCOM have evidence demonstrating — 

(i) the prevalence, and 

(ii) the persistent presence, 
of terrorism content or CSEA content or both (as the case may be) on the 
service, 

(b) OFCOM are satisfied that no less intrusive step than the use of the 
technology to be specified in the notice is likely to achieve the necessary 
reduction in terrorism content or CSEA content present on the service, 
and 

(c) OFCOM are satisfied that giving the notice is a proportionate means of 
addressing the problem of terrorism content or CSEA content present 
on the service. 


If a provider is already using accredited technology in relation to the service in 
question, a use of technology notice under this section may require the 
provider to use it more effectively (specifying the ways in which that must be 
done). 


A use of technology notice under this section may also require a provider to 
operate an effective complaints procedure allowing for United Kingdom users 
to challenge the take down of content which they have generated, uploaded or 
shared on the service. 


For the purposes of subsection (4)(a) terrorism content is “public” if it is 
generated, uploaded or shared on the service in question publicly, and a use of 
technology notice relating to terrorism content must identify the content, or 
parts of the service that include content, that OFCOM reasonably consider 
meets that description in the case of that service. 


OFCOM may vary or revoke a use of technology notice under this section by a 
further notice under this section. 


Use of technology notice: search service 


This section applies if — 

(a) a use of technology warning notice under section 63 relating to a 
particular regulated search service has been given to the provider of 
that service, and 

(b) the period allowed for representations has expired. 


If, after considering any representations and evidence, OFCOM decide not to 
give a use of technology notice to the provider, they must inform the provider 
of that fact. 


If the conditions mentioned in subsection (5) are met, OFCOM may give the 
provider a use of technology notice under this section. 
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(4) A use of technology notice under this section is a notice relating to a regulated 
search service requiring the provider of the service to do either or both of the 
following — 


(a) 


use accredited technology to identify terrorism content in search results 
and to swiftly take steps that result in that content no longer appearing 
in search results (either by means of the technology alone or by means 
of the technology together with the use of human moderators to review 
terrorism content identified by the technology); 

use accredited technology to identify CSEA content in search results 
and to swiftly take steps that result in that content no longer appearing 
in search results (either by means of the technology alone or by means 
of the technology together with the use of human moderators to review 
CSEA content identified by the technology). 


(5) The conditions which must be met in relation to the service are as follows — 


(a) 


(b) 


(c) 


OFCOM have evidence demonstrating — 

(i) the prevalence, and 

(ii) the persistent presence, 
of terrorism content or CSEA content or both (as the case may be) in 
search results of the service, 
OFCOM are satisfied that no less intrusive step than the use of the 
technology to be specified in the notice is likely to achieve the necessary 
reduction in terrorism content or CSEA content in search results of the 
service, and 
OFCOM are satisfied that giving the notice is a proportionate means of 
addressing the problem of terrorism content or CSEA content in search 
results of the service. 


6) Ifa provider is already using accredited technology in relation to the service in 
pr 7 vang l by me ; 

question, a use of technology notice under this section may require the 

provider to use it more effectively (specifying the ways in which that must be 


done). 


(7) A use of technology notice under this section may also require a provider to 
operate an effective complaints procedure allowing for an interested person to 
challenge steps taken by the provider that have resulted in content relating to 
that interested person no longer appearing in search results. 


(8) OFCOM may vary or revoke a use of technology notice under this section by a 
further notice under this section. 


66 Use of technology notices: supplementary 


(1) A use of technology notice must— 


give OFCOM’s reasons for their decision to give the notice, 

contain details of the requirements imposed by the notice, 

contain details of the technology to be used, 

specify the day by which the notice must be complied with, and the 
period for which it is to have effect, 

contain details of the rights of appeal under section 105, 

contain information about when OFCOM intend to review the notice 
(see section 67), and 
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67 


(g) contain information about the consequences of not complying with the 
notice (including information about the further kinds of enforcement 
action that it would be open to OFCOM to take). 


A use of technology notice may impose requirements for a period of up to 36 
months beginning with the day specified in the notice as the day by which the 
notice must be complied with. 


A use of technology notice may impose requirements only in relation to the 
operation of a regulated service — 

(a) inthe United Kingdom, or 

(b) as it affects United Kingdom users of the service. 


For the purposes of sections 64 and 65, technology is “accredited” if it is 
accredited (by OFCOM or another person appointed by OFCOM) as meeting 
minimum standards of accuracy in the detection of terrorism content or CSEA 
content (as the case may be). 


Those minimum standards of accuracy must be such standards as are for the 
time being approved and published by the Secretary of State, following advice 
from OFCOM. 


In this section “use of technology notice” means a use of technology notice 
under section 64 or 65. 


Further use of technology notice 


This section applies where OFCOM have given a provider of a regulated 
service a use of technology notice under section 64 or 65. 


If, at any time during the period for which the notice has effect — 
(a) there are reasonable grounds for believing that the provider is failing to 
comply with the notice, and 
(b) the conditions for giving a use of technology notice, as set out in section 
64(5) or 65(5) (whichever applies), are still met in relation to the service 
in question, 
OFCOM may revoke the notice and give the provider a further use of 
technology notice under this section. 


Except where the use of technology notice is revoked under subsection (2), 
OFCOM must, before the end of the period for which the notice has effect, 
carry out a review of the use of the specified technology by the provider in 
relation to the service in question. 


The review must consider — 
(a) the extent to which the specified technology has been used, and 
(b) the effectiveness of its use. 


Following the review, and after consultation with the provider, OFCOM may 
give the provider a further use of technology notice under this section if 
OFCOM reasonably consider that there is a significant risk that, without the 
continued use of accredited technology, terrorism content or CSEA content (or 
both) will be prevalent, and persistently present — 

(a) inthe case of a user-to-user service, on the service; 

(b) inthe case of a search service, in search results of the service. 


If a further use of technology notice is given, subsections (2) to (5) apply again. 
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(7) A further use of technology notice may require the use of different accredited 
technology from an earlier use of technology notice. 


(8) Subsections (4) and (6) to (9) of section 64, and section 66, apply in relation to a 
further use of technology notice under this section relating to a user-to-user 
service as they apply in relation to a use of technology notice under section 64. 


(9) Subsections (4) and (6) to (8) of section 65, and section 66, apply in relation to a 
further use of technology notice under this section relating to a search service 
as they apply in relation to a use of technology notice under section 65. 


(10) In this section “specified” means specified in a use of technology notice under 
section 64 or 65 (as the case may be). 
68 Guidance about requiring use of technology 


(1) OFCOM must prepare guidance for providers of regulated services about how 
OFCOM propose to exercise their functions under this Chapter. 


(2) OFCOM must keep the guidance under review. 


(3) OFCOM must publish the guidance (and any revised or replacement 
guidance). 


(4) In exercising their functions under this Chapter, or deciding whether to 
exercise them, OFCOM must have regard to the guidance for the time being in 
force under this section. 


69 Annual report about use of technology 


1) OFCOM must prepare and publish an annual report about — 
prep P P 
(a) the exercise of their functions under this Chapter, and 


(b) technology which meets, or is in the process of development so as to 
meet, minimum standards of accuracy (see subsections (4) and (5) of 
section 66) for the purposes of this Chapter. 


(2) OFCOM must send a copy of the report to the Secretary of State who must lay 
the copy before Parliament. 


(3) For further provision about reports under this section, see section 102. 


CHAPTER 5 


INFORMATION 
Information power 


70 Power to require information 


(1) OFCOM may by notice (an “information notice”) require a person within 
subsection (3) to provide them with any information that they require for the 
purpose of exercising, or deciding whether to exercise, any of their online 
safety functions. 
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(2) The power in subsection (1) may only be exercised to require a person within 
subsection (3) to provide information which OFCOM believe that person has 
or is able to generate or obtain. 


(3) The persons within this subsection are — 

(a) a provider of a user-to-user service or a search service, 

(b) a person who provides an ancillary service (within the meaning of 
section 91) in relation to a regulated service (see subsections (11) and 
(12) of that section), 

(c) aperson who provides an access facility (within the meaning of section 
93) in relation to a regulated service (see subsections (10) and (11) of 
that section), and 

(d) any other person who OFCOM believe has, or is able to generate or 
obtain, information required by them as mentioned in subsection (1). 


(4) The information that may be required by OFCOM under subsection (1) 
includes, in particular, information that they require for any one or more of the 
following purposes — 

(a) the purpose of assessing compliance by a provider of a regulated 
service with— 

(i) any duty or requirement set out in Chapter 2, 3 or 4 of Part 2, or 
(ii) any requirement relating to transparency reporting (see section 
49(1) and (2)); 

(b) the purpose of assessing compliance by a provider of a regulated 
service with a requirement under section 51 (duty to notify OFCOM in 
relation to the charging of fees); 

(c) the purpose of determining OFCOM’s proposed figure as mentioned in 
section 53 (threshold figure for the purposes of charging fees) or 
assessing whether the threshold figure remains appropriate; 

(d) the purpose of ascertaining the amount of a person’s qualifying 
worldwide revenue for the purposes of — 

(i) section 52 (duty to pay fees), or 
(ii) section 85 or 86 (amount of penalties); 

(e) the purpose of assessing compliance with any requirements imposed 
on a person by a confirmation decision; 

(f) the purpose of dealing with complaints made to OFCOM under section 
106 (super-complaints); 

(g) the purpose of OFCOM’s advice to the Secretary of State about 
provision to be made by regulations under paragraph 1 of Schedule 4 
(threshold conditions for categories of regulated services); 

(h) the purpose of determining whether a regulated service meets 
threshold conditions specified in regulations under paragraph 1 of 
Schedule 4; 

(i) the purpose of preparing a code of practice under section 29; 
(j) the purpose of preparing guidance in relation to online safety matters; 

(k) the purpose of carrying out research, or preparing a report, in relation 
to online safety matters; 

(1) the purpose of complying with OFCOM’s duty under section 11 of the 
Communications Act, so far as relating to regulated services (duty to 
promote media literacy). 


(5) See also section 71 (power to include a requirement to name a senior manager). 
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The information required may include information held in any form (including 
in electronic form). 


Where OFCOM require documents to be produced, OFCOM may — 
(a) take copies of or extracts from any document so produced, 
(b) request any person producing a document to give an explanation of it, 
and 
(c) where that person is an entity, request any person who is an officer of 
the entity to give such an explanation. 


An information notice must — 
(a) specify or describe the information to be provided, 
) specify why OFCOM require the information, 
(c) specify where it must be provided, 
(d) specify the form and manner in which it must be provided, and 
(e) contain information about the consequences of not complying with the 


notice (including information about the kinds of enforcement action 
that it would be open to OFCOM to take). 


An information notice must specify when the information must be provided 
(which may be by a specified date, within a specified period, or at specified 
intervals). 


A person to whom an information notice is given has a duty — 
(a) to provide the information in accordance with the requirements of the 
notice, and 
(b) to ensure that the information provided is accurate in all material 
respects. 


OFCOM may cancel an information notice by notice to the person to whom it 
was given. 


The power in subsection (1) does not include power to require the provision of 
information in respect of which a claim to legal professional privilege (or, in 
Scotland, to confidentiality of communications) could be maintained in legal 
proceedings. 


In this section “provider of a regulated service” includes a person who was at 
any time a provider of a regulated service but who has ceased to be a provider 
of such a service. 


In this section— 
“information” includes documents, and any reference to providing 
information includes a reference to producing a document; 
“officer”, in relation to an entity, includes a director, a manager, a 
secretary or, where the affairs of the entity are managed by its 
members, a member. 


In relation to information recorded otherwise than in legible form, references 
in this section to producing a document are to producing a copy of the 
information in legible form. 


Requirement to name a senior manager 


This section applies where — 
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(1) 


a) OFCOM give a provider of a regulated service an information notice, 
8 pP 8 
and 


(b) the provider is an entity. 


OFCOM may include in the information notice a requirement that the provider 
must name, in their response to the notice, an individual who the provider 
considers to be a senior manager of the entity. 


If OFCOM impose a requirement to name an individual, the information notice 
must— 


(a) require the provider to inform such an individual, and 


(b) include information about the consequences for such an individual of 
the entity’s failure to comply with the requirements of the notice (see 
section 73). 


For the purposes of this section an individual is a “senior manager” of an entity 
if the individual plays a significant role in — 


(a) the making of decisions about how the entity’s relevant activities are to 
be managed or organised, or 


(b) the actual managing or organising of the entity’s relevant activities. 


An entity’s “relevant activities” means activities relating to the entity’s 
compliance with the regulatory requirements imposed by this Act in 
connection with the regulated service to which the information notice in 
question relates. 


Information offences 


Offences in connection with information notices 


An offence under this section may be committed only by a person who — 
(a) is given an information notice in relation to a regulated service, and 
(b) is the provider of that service, 

and references to “person” are to such a person. 


A person commits an offence if the person fails to comply with a requirement 
of an information notice. 


It is a defence for a person charged with the offence in subsection (2) to show 
that— 


(a) it was not reasonably practicable to comply with the requirements of 
the information notice at the time required by the notice, but 


(b) the person has subsequently taken all reasonable steps to comply with 
those requirements. 


A person commits an offence if, in response to an information notice — 
(a) the person provides or publishes information or produces a document, 
(b) the information or document is false in a material respect, and 


(c) at the time the person provides, publishes or produces it, the person 
knows that it is false in a material respect or is reckless as to whether it 
is false in a material respect. 


A person commits an offence if, in response to an information notice, the 
person — 
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(a) provides or publishes information or produces a document which is 
encrypted such that it is not possible for OFCOM to understand it, and 


(b) the person’s intention was to prevent OFCOM from understanding the 
information or document. 


A person who commits an offence under this section is liable — 
(a) onsummary conviction in England and Wales, to a fine; 


(b) on summary conviction in Scotland or Northern Ireland, to a fine not 
exceeding the statutory maximum; 


(c) on conviction on indictment, to imprisonment for a term not exceeding 
two years or a fine (or both). 


Senior managers’ liability: information offences 


In this section “an individual named as a senior manager of an entity” means 
an individual who, as required by an information notice, is named as a senior 
manager of an entity in a response to that notice (see section 71). 


An individual named as a senior manager of an entity commits an offence if — 
(a) the entity commits an offence under section 72(2) (failure to comply 
with information notice), and 


(b) the individual has failed to take all reasonable steps to prevent that 
offence being committed. 


It is a defence for an individual charged with an offence under subsection (2) 
to show that the individual was not a senior manager within the meaning of 
section 71 for the duration of the period — 
(a) beginning with the date on which the information notice in question 
was given, and 
(b) ending with the last day of the period of four weeks beginning with the 
date by which the information notice must be complied with. 


An individual named as a senior manager of an entity commits an offence if — 
(a) the entity commits an offence under section 72(4) (false information), 
and 


(b) the individual has failed to take all reasonable steps to prevent that 
offence being committed. 


An individual named as a senior manager of an entity commits an offence if — 
(a) the entity commits an offence under section 72(5) (encrypted 
information), and 


(b) the individual has failed to take all reasonable steps to prevent that 
offence being committed. 


It is a defence for an individual charged with an offence under subsection (4) 
or (5) to show that the individual was not a senior manager within the meaning 
of section 71 at the time at which the act constituting the offence occurred. 


It is a defence for an individual charged with an offence under subsection (2), 
(4) or (5) to show that the individual had no knowledge of being named as a 
senior manager in a response to the information notice in question. 


An individual who commits an offence under this section is liable — 
(a) onsummary conviction in England and Wales, to a fine; 
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74 
(1) 


(b) on summary conviction in Scotland or Northern Ireland, to a fine not 
exceeding the statutory maximum; 


(c) on conviction on indictment, to imprisonment for a term not exceeding 
two years or a fine (or both). 


Skilled persons' reports 


Reports by skilled persons 


OFCOM may exercise the powers in this section where OFCOM reasonably 
consider that it is necessary to do so for either or both of the following 
purposes — 

(a) assisting OFCOM in identifying and assessing a failure, or possible 
failure, by a provider of a regulated service to comply with a relevant 
requirement, or 

(b) developing OFCOM’s understanding of — 

(i) the nature and level of risk of a provider of a regulated service 
failing to comply with a relevant requirement, and 
(ii) ways to mitigate such a risk. 


But the powers in this section may be exercised for a purpose mentioned in 
subsection (1)(b) only where OFCOM reasonably consider that the provider in 
question may be at risk of failing to comply with a relevant requirement. 


OFCOM may appoint a skilled person to provide OFCOM with a report about 
matters relevant to the purpose for which the powers under this section are 
exercised (“the relevant matters”), and, where OFCOM make such an 
appointment, they must notify the provider about the appointment and the 
relevant matters to be explored in the report. 


Alternatively, OFCOM may give a notice to the provider — 
(a) requiring the provider to appoint a skilled person to provide OFCOM 
with a report in such form as may be specified in the notice, and 
(b) specifying the relevant matters to be explored in the report. 


References in this section to a skilled person are to a person— 


(a) appearing to OFCOM to have the skills necessary to prepare a report 
about the relevant matters, and 


(b) where the appointment is to be made by the provider, nominated or 
approved by OFCOM. 


The provider of the service is liable for the payment, directly to the skilled 
person, of the skilled person’s remuneration and expenses relating to the 
preparation of the report. 


Section 87(2) to (4) apply in relation to an amount due to a skilled person under 
subsection (6) of this section as they apply in relation to a penalty as defined in 
section 87. 


It is the duty of — 
(a) the provider of the service (“P”), 
(b) any person who works for (or used to work for) P, or is providing (or 
used to provide) services to P related to the relevant matters, and 
(c) other providers of internet services, 
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to give the skilled person all such assistance as the skilled person may 
reasonably require to prepare the report. 


(9) In this section “relevant requirement” means — 
(a) aduty under section 7 or 19 (risk assessment duties), 
(b) a duty under section 9 or 21 (safety duties about illegal content), 


(c) a duty under section 10 or 22 (safety duties for services likely to be 
accessed by children), 
) aduty under section 11 (safety duties protecting adults), 
) aduty under section 15 or 24 (reporting and redress duties), 
(f) a duty under section 16 or 25 (record-keeping and review duties), 

) arequirement under section 49(1) or (2) (transparency reports), 

) a requirement under section 51 to notify OFCOM in connection with 
the charging of fees (see subsections (1), (3) and (4) of that section), and 


(i) a requirement imposed by a use of technology notice under section 64, 
65 or 67. 


Investigations and interviews 


75 Investigations by OFCOM 


(1) IfOFCOM open an investigation into whether a provider of a regulated service 
has failed, or is failing, to comply with any relevant requirement, the provider 
must co-operate fully with the investigation. 


(2) In this section “relevant requirement” means — 

(a) a duty or requirement referred to in section 82 (except that it does not 
include a reference to the requirement referred to in paragraph (v) of 
that section), and 

(b) a requirement imposed by a use of technology notice under section 64, 
65 or 67. 


76 Power to require interviews 


(1) The power under this section is exercisable by OFCOM for the purposes of an 
investigation that they are carrying out into the failure, or possible failure, of a 
provider of a regulated service to comply with a relevant requirement. 


(2) OFCOM may by notice require the provider to arrange for an individual within 
subsection (4) to attend an interview (in person or remotely) within a period 
specified in the notice and answer questions about any matter relevant to the 
investigation. 


— 
Q 
wm 


The notice must indicate the subject matter and purpose of the interview. 


— 
A 
xor 


The following are within this subsection — 
(a) amember or officer of the provider of the regulated service, 
(b) anemployee of the provider, and 


(c) anindividual who fell within paragraph (a) or (b) at a time to which the 
information or explanation required by OFCOM relates. 


(5) Nothing in this section compels a person to disclose information in respect of 
which a claim to legal professional privilege (or, in Scotland, to confidentiality 
of communications) could be maintained in legal proceedings. 
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(6) In this section “relevant requirement” has the meaning given by section 74. 
Powers of entry and inspection 


77 Powers of entry and inspection 


Schedule 5 makes provision about powers of entry and inspection. 
Disclosure of information 


78 Provision of information to the Secretary of State 


(1) Section 24B of the Communications Act (provision of information to assist in 
formulation of policy) is amended as follows. 


(2) In subsection (2) — 
(a) atthe end of paragraph (d) omit “or”, 
(b) at the end of paragraph (e) insert “or”, and 
(c) after paragraph (e) insert — 
“(f) the Online Safety Act 2021,”. 


(3) After subsection (2) insert — 


“(3) But subsection (2) does not apply to information— 
(a) obtained by OFCOM — 

(i) in the exercise of a power conferred by section 70 of the 
Online Safety Act 2021 for the purpose mentioned in 
subsection (4)(c) of that section (information in 
connection with the setting of a threshold figure for the 
purposes of charging fees), or 

(ii) in the exercise of a power conferred by section 112(5) of 
that Act (information in connection with circumstances 
presenting a threat), and 


(b) reasonably required by the Secretary of State.” 


79 Disclosure of information 


(1) Section 393 of the Communications Act (general restrictions on disclosure of 
information) is amended as follows. 

(2) In subsection (1) — 

(a) atthe end of paragraph (c) omit “or”, 

(b) at the end of paragraph (d) insert “or”, and 

(c) after paragraph (d) insert — 

“(e) the Online Safety Act 2021,”. 

(3) In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2021”. 


(4) In subsection (6)(a), after “390” insert “, or under Schedule 4 to the Online 
Safety Act 2021”. 


(5) In subsection (6)(b), at the end insert “or the Online Safety Act 2021”. 
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CHAPTER 6 


ENFORCEMENT POWERS 
Provisional notices and confirmation decisions 


Provisional notice of enforcement action 


OFCOM may, in accordance with this section, give a person a notice stating 
that they intend to take enforcement action (a “provisional notice of 
enforcement action”). 


Subject to section 81, OFCOM may give a provisional notice of enforcement 
action relating to a regulated service to the provider of the service if they 
consider that there are reasonable grounds for believing that the provider has 
failed, or is failing, to comply with any enforceable requirement referred to in 
section 82 that applies in relation to the service. 


OFCOM may also give a provisional notice of enforcement action to a person 
on either of the grounds in subsection (4). 


The grounds are— 


(a) the person has been given an information notice and OFCOM consider 
that there are reasonable grounds for believing that the person has 
failed, or is failing, to comply with either of the duties set out in section 
70(10) (duties in relation to information notices), or 


(b) the person is required by a skilled person appointed under section 74 
to give assistance to the skilled person, and OFCOM consider that there 
are reasonable grounds for believing that the person is in breach of the 
duty in subsection (8) of that section to give such assistance. 


A provisional notice of enforcement action given to a person must — 
(a) specify the duty or requirement with which (in OFCOM’s opinion) the 
person has failed, or is failing, to comply, 
(b) give OFCOM’s reasons for their opinion that the person has failed, or 
is failing, to comply with it, and 
(c) specify what steps OFCOM consider the person needs to take in order 
to— 
(i) comply with it, or 
(ii) remedy the failure. 


A provisional notice of enforcement action may also state that OFCOM 
propose to impose a penalty on the person, and in such a case the notice must — 


(a) state the reasons why OFCOM propose to impose a penalty, and 


(b) indicate the amount of the penalty that OFCOM propose to impose, 
including any aggravating or mitigating factors that they propose to 
take into account. 


A provisional notice of enforcement action given to a person must — 


(a) state that the person may make written representations (with any 
supporting evidence) about the matters contained in the notice, and 


(b) specify the period within which such representations may be made. 


A provisional notice of enforcement action may be given in respect of a failure 
to comply with more than one enforceable requirement. 
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(9) Where a provisional notice of enforcement action is given in respect of a 
continuing failure, the notice may be given in respect of any period during 
which the failure has continued, and must specify that period. 


(10) Where a provisional notice of enforcement action is given to a person in respect 
of a failure to comply with a duty or requirement (“the first notice”), a further 
provisional notice of enforcement action in respect of a failure to comply with 
that same duty or requirement may be given to the person only — 

(a) in respect of a separate instance of the failure after the time at which the 
first notice was given, 

(b) where a period was specified in the first notice in accordance with 
subsection (9), in respect of the continuation of the failure after the end 
of that period, or 

(c) ifthe first notice has been withdrawn without a penalty being imposed 
by a confirmation decision in respect of the failure (see section 83(6)). 


81 Prevalent and persistent terrorism or CSEA content 


(1) This section applies where OFCOM consider that there are reasonable grounds 
for believing that a person is failing to comply with the duty in section 9 or (as 
the case may be) 21 (safety duties about illegal content), so far as relating to 
terrorism content or CSEA content (or both those kinds of content), in relation 
to a regulated service of which that person is the provider, based on evidence 
demonstrating the prevalence, and persistent presence, of terrorism content or 
CSEA content (or both) — 

(a) inthe case of a user-to-user service, on the service; 


(b) inthe case of a search service, in search results of the service. 


(2) OFCOM may not give the person a provisional notice of enforcement action if 
they are satisfied that the person is complying with all other enforceable 
requirements referred to in section 82 that apply in relation to the service. 


(3) If however OFCOM consider that there are reasonable grounds for believing 
that the person has failed, or is failing, to comply with any other enforceable 
requirement that applies in relation to the service, OFCOM may give the 
person a provisional notice of enforcement action in relation to that failure. 


(4) See section 63 for action that OFCOM may take where this section applies (use 
of technology warning notice). 


(5) In a case mentioned in subsection (3), OFCOM may give a person both a 
provisional notice of enforcement action and a use of technology warning 
notice under section 63. 


82 Requirements enforceable by OFCOM against providers of regulated services 


The following are the “enforceable requirements” mentioned in this Chapter — 


(a) each of the duties set out in section 7 (duties relating to risk 
assessments), 


(b) each of the duties set out in section 9 (safety duties about illegal 
content), 


(c) each of the duties set out in section 10 (safety duties for services likely 
to be accessed by children), 


(d) each of the duties set out in section 11 (safety duties protecting adults), 
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each of the duties set out in section 12 (duties about rights to freedom 
of expression and privacy), 


each of the duties set out in section 13 (duties to protect content of 
democratic importance), 

each of the duties set out in section 14 (duties to protect journalistic 
content), 

each of the duties set out in section 15 (reporting and redress duties), 
each of the duties set out in section 16 (record-keeping and review 
duties), 

each of the duties set out in section 19 (duties to carry out risk 
assessments), 


each of the duties set out in section 21 (safety duties about illegal 
content), 


each of the duties set out in section 22 (safety duties for services likely 
to be accessed by children), 

the duty set out in section 23 (duty about rights to freedom of 
expression and privacy), 

each of the duties set out in section 24 (reporting and redress duties), 
each of the duties set out in section 25 (record-keeping and review 
duties), 

the requirements set out in section 26(1), (6) and (7) (assessments about 
access by children), 

the requirements under section 49(1) and (2) (transparency reports), 

a requirement under section 51 to notify OFCOM in connection with 
the charging of fees (see subsections (1), (3) and (4) of that section), 
each of the duties under section 70(10) (information notices), 

the requirement under section 74(4)(a) to appoint a skilled person to 
prepare a report, 

the duty under section 74(8) to give such assistance to a skilled person 
appointed to prepare a report as is reasonably required by the skilled 
person, 

the requirement under section 75(1) to co-operate with an investigation 
carried out by OFCOM, 

the requirement under section 76(2) to arrange for an individual to 
attend an interview with OFCOM, 

the requirements of a notice given by virtue of section 112(3) (duty to 
make public statement), and 

the requirements of a notice under section 112(5) (information in 
connection with circumstances presenting a threat). 


83 Confirmation decisions 


(1) This section applies if — 


(a) 


(b) 


a provisional notice of enforcement action has been given to a person in 
relation to a failure to comply with a duty or requirement (or with 
duties or requirements), and 


the period allowed for representations has expired. 


A duty or requirement to which the provisional notice of enforcement action 
relates is referred to in this section as a “notified requirement”. 
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(2) 


(3) 


If, after considering any representations and evidence, OFCOM decide not to 
give a confirmation decision to the person, they must inform the person of that 
fact. 


If the conditions in subsection (5) or (6) are met, OFCOM may give the person 
a confirmation decision. 


A confirmation decision is a notice — 


(a) 
(b) 
(c) 


imposing requirements as described in subsection (5), 
imposing a penalty as described in subsection (6), or 
doing both those things. 


(5) If OFCOM are satisfied that the person— 


(a) 
(b) 


has failed, or has been failing, to comply with a notified requirement, 
and 
is still failing to comply with it, 


the confirmation decision may require the person to take steps to comply with 
that requirement or to remedy the failure. 


(6) If— 
(a) 


(b) 


the provisional notice of enforcement action states that OFCOM 
propose to impose a penalty, and 

OFCOM are satisfied that the person has failed, or has been failing, to 
comply with a notified requirement, 


the confirmation decision may require the person to pay to OFCOM a penalty 
of an amount in sterling specified in the decision. 


A confirmation decision that includes requirements as described in subsection 
(5) must — 


give OFCOM’s reasons for their decision to impose those requirements, 
specify any notified requirement, 
require the person to whom the notice is given to take steps specified in 
the confirmation decision in order to— 
(i) comply with any notified requirement, or 

(ii) remedy the failure to comply with any notified requirement, 
specify the period within which those steps must be taken, 
contain details of the rights of appeal under section 105, and 


contain information about the consequences of not complying with the 
confirmation decision (including information about the further kinds of 
enforcement action that it would be open to OFCOM to take). 


(8) A confirmation decision that includes a requirement to pay a penalty must — 


(a) 


give OFCOM’s reasons for their decision to impose the penalty, 
specify any notified requirement, 

state the reasons for the amount of the penalty, including any 
aggravating or mitigating factors that OFCOM have taken into account, 
specify the period within which the penalty must be paid, 

contain details of the rights of appeal under section 105, and 

contain information about the consequences of not paying the penalty 
(including information about the further kinds of enforcement action 
that it would be open to OFCOM to take). 


(9) The period specified under subsection (8)(d) must be not less than 28 days 
beginning with the day on which the confirmation decision is given. 
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A confirmation decision may impose requirements as described in subsection 
(5) only in relation to the design or operation of a regulated service — 

(a) inthe United Kingdom, or 

(b) as it affects United Kingdom users of the service. 


A confirmation decision may not impose a requirement — 

(a) in the case of a user-to-user service, to use technology to identify a 
particular kind of content present on the service with a view to taking 
down such content; 

(b) inthe case of a search service, to use technology to identify a particular 
kind of content in search results with a view to such content no longer 
appearing in search results. 


A confirmation decision may impose separate penalties for failure to comply 
with separate notified requirements specified in the decision. 


Where a provisional notice of enforcement action is given in respect of a period 
of continuing failure, no more than one penalty may be imposed by a 
confirmation decision in respect of the period of failure specified in the 
provisional notice of enforcement action. 


But where a confirmation decision includes a requirement as described in 
subsection (5) in respect of a continuing failure, the confirmation decision may 
impose a penalty in respect of each day that that same failure continues after 
the expiry of the period specified in the confirmation decision as the period 
within which the requirements imposed by that decision must be complied 
with. 


Compliance with certain requirements of confirmation decisions 


A person to whom a confirmation decision is given has a duty to comply with 
requirements included in the decision which are of a kind mentioned in section 
83(5). 
The duty under subsection (1) is enforceable in civil proceedings by OFCOM — 
(a) for an injunction, 
(b) for specific performance of a statutory duty under section 45 of the 
Court of Session Act 1988, or 
(c) for any other appropriate remedy or relief. 


OFCOM may give a person a penalty notice under this section if they are 
satisfied that the person has failed to comply with requirements included ina 
confirmation decision which are of a kind mentioned in section 83(5). 


A penalty notice under this section is a notice given to a person on the ground 
in subsection (3) requiring the person to pay to OFCOM a penalty of an amount 
in sterling specified in the notice. 


A penalty notice under this section must — 
(a) give OFCOM’s reasons for their decision to give the penalty notice, 


(b) state the reasons for the amount of the penalty, including any 
aggravating or mitigating factors that OFCOM have taken into account, 


(c) specify the period within which the penalty must be paid, 
(d) contain details of the rights of appeal under section 105, and 
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(e) contain information about the consequences of not paying the penalty 
(including information about the further kinds of enforcement action 
that it would be open to OFCOM to take). 


(6) The period specified under subsection (5)(c) must be not less than 28 days 
beginning with the day on which the penalty notice is given. 


85 Amount of penalties 


(1) Subsections (2) to (9) apply in relation to a penalty imposed by — 
(a) aconfirmation decision (see section 83(6)), or 
(b) a penalty notice under section 84(3). 


(2) In determining the amount of a penalty to be imposed on a person, OFCOM 
must, in particular, take into account — 
(a) any representations made, and evidence provided, by the person; 
(b) any steps taken by the person towards — 
(i) complying with any duty or requirement specified in (as the 
case may be) — 
(a) the provisional notice of enforcement action given to the 
person, or 
(b) the confirmation decision given to the person, or 
(ii) remedying the failure to comply with any such duty or 
requirement; and 
(c) the effects of the failure (or failures) in respect of which the penalty is 
imposed. 


(3) A penalty must be of an amount that OFCOM consider to be — 
(a) appropriate, and 
(b) proportionate to the failure (or failures) in respect of which it is 
imposed. 


(4) Where a penalty is imposed on a person in respect of a regulated service 
provided by that person, the maximum amount of the penalty for which the 
person is liable is whichever is the greater of — 

(a) £18 million, and 


(b) 10% of the person’s qualifying worldwide revenue. 


(5) But if the person does not have an accounting period, the maximum amount of 
the penalty for which the person is liable is £18 million. 


(6) The maximum amount of a penalty for which a person not within subsection 
(4) is liable is £18 million. 


(7) For the purposes of subsection (4)(b), a person’s “qualifying worldwide 
revenue” is — 
(a) the amount of the person’s qualifying worldwide revenue for the 
person’s most recent complete accounting period; or 
(b) where OFCOM are deciding the amount of the penalty at a time when 
that person’s first accounting period has not yet ended, the amount that 
OFCOM estimate to be the person’s likely qualifying worldwide 
revenue for that period. 


(8) But— 
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(a) if the duration of a person’s most recent complete accounting period is 
less than a year, the amount mentioned in subsection (7)(a) or (b) is to 
be proportionately increased; 

(b) if the duration of a person’s most recent complete accounting period is 
more than a year, that amount is to be proportionately reduced. 


For the purposes of subsection (7), the amount of a person’s qualifying 
worldwide revenue for an accounting period is, in the event of a disagreement 
between the person and OFCOM, the amount determined by OFCOM. 


The amount of a penalty imposed on a person by a confirmation decision may 
not exceed the amount of the penalty proposed in the provisional notice of 
enforcement action given to the person. 


Subsections (4) to (6) also apply to determine the maximum aggregate amount 
of daily penalties imposed by a confirmation decision (see section 83(14)). 


See also section 392 of the Communications Act (which requires OFCOM to 
produce guidelines about their determination of the amount of penalties that 
they impose). 
In this section “accounting period” means a period in respect of which a person 
is required (by law or, in the case of an entity, the constitution of the entity) to 
prepare accounts — 

(a) in the case of an entity, in respect of the entity, or 


(b) in the case of an individual, in respect of the individual’s business of 
providing a regulated service. 


In this section “qualifying worldwide revenue” has the meaning given to it by 
regulations made by the Secretary of State. 


The Secretary of State must consult OFCOM before making regulations under 
subsection (14). 


Amount of penalties: group of entities 


This section applies if, in accordance with section 119 or 121, two entities are 
jointly and severally liable for a penalty imposed by — 

(a) aconfirmation decision (see section 83(6)), or 

(b) a penalty notice under section 84(3). 


Subsections (3) to (5) of this section apply instead of section 85(4) to (7). 


The maximum amount of the penalty is whichever is the greater of — 
(a) £18 million, and 
(b) 10% of the qualifying worldwide revenue of the group of entities of 
which the two entities are members. 


For the purposes of subsection (3)(b), the “qualifying worldwide revenue” of a 
group of entities is— 

(a) the amount of the group’s qualifying worldwide revenue for the most 
recent complete accounting period of the entities liable for the penalty; 
or 

(b) where OFCOM are deciding the amount of the penalty at a time when 
the first accounting period of the entities liable for the penalty has not 
yet ended, the amount that OFCOM estimate to be the group’s likely 
qualifying worldwide revenue for that period. 
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(5) Ina case where the accounting periods of the entities liable for the penalty are 
different — 

(a) the reference in subsection (4)(a) to the accounting period of the entities 
is to be read as a reference to the accounting period of either of the 
entities (at OFCOM’s discretion), and 

(b) subsection (4)(b) is to apply as if — 

(i) for “the first accounting period of the entities” there were 
substituted “the first accounting period of both of the entities”, 
and 

(ii) for “that period” there were substituted “the accounting period 
of either of the entities (at OFCOM’s discretion)”. 


(6) Subsections (8) and (9) of section 85 are to be read with the necessary 
modifications in their application for the purposes of this section. 


(7) In this section, “qualifying worldwide revenue” has the same meaning as in 
section 85, and regulations under subsection (14) of that section may include 
provision dealing with the application of that term to a group of entities. 


(8) In this section— 

“accounting period” means a period in respect of which an entity is 
required (by law or the constitution of the entity) to prepare accounts; 

“sroup of entities’ means a parent undertaking and its subsidiary 
undertakings (and the reference to a member of a group of entities is to 
be read accordingly); 

“parent undertaking” and “subsidiary undertaking” are to be read in 
accordance with section 1162 of the Companies Act 2006. 


(9) For the purposes of this section, section 1162 of, and Schedule 7 to, the 
Companies Act 2006 — 

(a) are to apply in relation to an entity which is not an undertaking (as 
defined in section 1161(1) of that Act) as they apply in relation to an 
undertaking, and 

(b) are to be read with any necessary modifications if applied to an entity 
formed under the law of a country outside the United Kingdom. 


87 Penalties: further provision 
(1) A penalty must be paid into the Consolidated Fund of the United Kingdom. 


(2) In England and Wales, a penalty is recoverable — 
(a) if the county court so orders, as if it were payable under an order of that 
court; 
(b) if the High Court so orders, as if it were payable under an order of that 
court. 


(3) In Scotland, a penalty may be enforced in the same manner as an extract 
registered decree arbitral bearing a warrant for execution issued by the sheriff 
court of any sheriffdom in Scotland. 


(4) In Northern Ireland, a penalty is recoverable — 
(a) if a county court so orders, as if it were payable under an order of that 
court; 


(b) if the High Court so orders, as if it were payable under an order of that 
court. 
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(5) In this section “penalty” means a penalty imposed by — 
(a) aconfirmation decision (see section 83(6)), or 
(b) a penalty notice under section 84(3). 


Non-payment of fee 


88 Notice about non-payment of fee 


(1) OFCOM may give a notice under this section to a provider of a regulated 
service if — 


(a) the provider is liable to pay a fee to OFCOM under section 52 in respect 
of the current charging year (within the meaning of that section) or a 
previous charging year, and 


(b) in OFCOM’s opinion, the provider has not paid the full amount of the 
fee that the provider is liable to pay. 


(2) The notice must— 


(a) specify the outstanding amount of the fee that OFCOM consider the 
provider is due to pay to them under section 52, and 
(b) specify a period within which the provider must pay it. 


(3) The notice must also— 


(a) state that the provider may make written representations (with any 
supporting evidence) about the matters contained in the notice, and 
(b) specify the period within which such representations may be made. 


(4) The notice may be given in respect of more than one liability to pay a fee under 
section 52. 


89 Penalty notice for non-payment of fee 


(1) OFCOM may give a provider of a regulated service a penalty notice under this 
section if — 


(a) anotice under section 88 has been given to the provider specifying an 
outstanding amount of a fee for which the provider is liable, 


(b) the period allowed for representations has expired, and 
(c) OFCOM are satisfied that an amount of the fee is still due to OFCOM. 


(2) A penalty notice under this section is a notice given to a provider of a regulated 
service on the grounds in subsection (1) requiring the provider to pay to 
OFCOM a penalty of an amount in sterling specified in the notice. 


(3) In determining the amount of a penalty, OFCOM must, in particular, take into 


account — 
(a) any representations made, and evidence provided, by the provider, 
and 
(b) any steps taken by the provider towards paying any amount of the fee 
due to OFCOM. 


(4) A penalty notice under this section must — 


(a) specify the amount of the fee that is (in OFCOM’s opinion) due to be 
paid to OFCOM, 


(b) give OFCOM’s reasons for their decision to give the penalty notice, 


10 


15 


20 


25 


30 


35 


40 


Online Safety Bill 79 
Part 4 — OFCOM's powers and duties in relation to regulated services 
Chapter 6 — Enforcement powers 


90 
(1) 


(c) state the reasons for the amount of the penalty, including any 
aggravating or mitigating factors that OFCOM have taken into account, 

(d) specify the period within which the penalty must be paid, 

(e) contain details of the rights of appeal under section 105, and 

(f) contain information about the consequences of not paying the penalty 
(including information about the further kinds of enforcement action 
that it would be open to OFCOM to take). 


The period specified under subsection (4)(d) must be not less than 28 days 
beginning with the day on which the penalty notice is given. 


A penalty notice under this section may impose separate penalties in respect of 
separate liabilities specified in the penalty notice. 


Section 85(3) to (9), (13) and (14) and sections 86 and 87 apply in relation to a 
penalty under this section as they apply in relation to a penalty imposed by a 
confirmation decision or by a penalty notice under section 84(3). 


Nothing in this section affects OFCOM’s power to bring proceedings (whether 
before or after the imposition of a penalty by a notice under this section) for the 
recovery of the whole or part of an amount due to OFCOM under section 52. 


But OFCOM may not bring such proceedings unless a provider has first been 
notified under section 88 of the amount due to OFCOM. 


Non-compliance with use of technology notice 


Penalty notice for failure to comply with use of technology notice 


This section applies if — 
(a) OFCOM have given a use of technology notice under section 64, 65 or 
67 relating to a regulated service to the provider of that service, and 
(b) at any time during the period for which the notice has effect, OFCOM 
are satisfied that the provider has failed, or is failing, to comply with the 
notice. 


OFCOM may give the provider a penalty notice under this section requiring 
the provider to pay to OFCOM a penalty of an amount in sterling specified in 
the notice. 


But OFCOM may give such a notice to the provider only after — 

(a) notifying the provider that they intend to give a penalty notice under 
this section, specifying the grounds for doing so and indicating the 
amount of the proposed penalty, 

(b) giving the provider an opportunity to make representations, and 

(c) considering — 

(i) any representations that are made, and 


(ii) any steps taken by the provider towards complying with the 
use of technology notice. 


Nothing in this section is to be taken to prevent OFCOM from giving the 
provider a further use of technology notice under section 67, as well as giving 
a penalty notice under this section. 


A penalty notice under this section must — 
(a) give OFCOM’s reasons for their decision to give the penalty notice, 
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(b) state the reasons for the amount of the penalty, including any 
aggravating or mitigating factors that OFCOM have taken into account, 

(c) specify the period within which the penalty must be paid, 

(d) contain details of the rights of appeal under section 105, and 

(e) contain information about the consequences of not paying the penalty 
(including information about the further kinds of enforcement action 
that it would be open to OFCOM to take). 


The period specified under subsection (5)(c) must be not less than 28 days 
beginning with the day on which the penalty notice is given. 


The amount of a penalty imposed on a provider under this section may not 
exceed the amount of the penalty proposed in the notice given to the provider 
under subsection (3). 


Section 85(3) to (9), (13) and (14) and sections 86 and 87 apply in relation to a 
penalty under this section as they apply in relation to a penalty imposed by a 
confirmation decision or by a penalty notice under section 84(3). 


Business disruption measures 


Service restriction orders 


OFCOM may apply to the court for an order under this section (a “service 
restriction order”) in relation to a regulated service where OFCOM consider 
that — 

(a) the grounds in subsection (3) apply in relation to the service, or 

(b) the grounds in subsection (4) apply in relation to the service. 


A service restriction order is an order imposing requirements on one or more 
persons who provide an ancillary service in relation to a regulated service (see 
subsection (11)). 


The grounds mentioned in subsection (1)(a) are that — 

(a) the provider of the regulated service has failed to comply with an 
enforceable requirement referred to in section 82 that applies in relation 
to the regulated service, 

(b) the failure is continuing, and 

(c) either— 

(i) the provider has failed to comply with a requirement imposed 
by a confirmation decision that is of a kind mentioned in section 
83(5) relating to the failure, 

(ii) the provider has failed to pay a penalty imposed by a 
confirmation decision relating to the failure (and the 
confirmation decision did not impose any requirements 
mentioned in section 83(5)), 

(iii) the provider would be likely to fail to comply with a 
confirmation decision if given, or 

(iv) the circumstances of the failure or the risks of harm to 
individuals in the United Kingdom are such that it is 
appropriate to make the application without having given a 
provisional notice of enforcement action, without having given 
a confirmation decision, or (having given a confirmation 
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decision) without waiting to ascertain compliance with the 
decision. 


(4) The grounds mentioned in subsection (1)(b) are that — 

(a) the provider of the regulated service has failed to comply with a use of 
technology notice under section 64, 65 or 67 that relates to the service, 
and 

(b) the failure is continuing. 


(5) An application by OFCOM for a service restriction order must — 

(a) specify the regulated service in relation to which the application is 
made (“the relevant service”), 

(b) specify the provider of that service (“the non-compliant provider’), 

(c) specify the grounds on which the application is based, and contain 
evidence as to such grounds, 

(d) specify the persons on whom (in OFCOM’s opinion) the requirements 
of the order should be imposed, 

(e) contain evidence as to why OFCOM consider that the persons 
mentioned in paragraph (d) provide an ancillary service in relation to 
the relevant service, and specify any such ancillary service provided, 

(f) specify the requirements which OFCOM consider that the order should 
impose on such persons, and 

(g) inthe case of an application made without notice having been given to 
the non-compliant provider, or to the persons mentioned in paragraph 
(d), state why no notice has been given. 


(6) The court may make a service restriction order imposing requirements on a 
person in relation to the relevant service if the court is satisfied — 

(a) as to the grounds in subsection (3) or the grounds in subsection (4) (as 
the case may be), 

(b) that the person provides an ancillary service in relation to the relevant 
service, 

(c) that it is appropriate to make the order for the purposes of preventing 
harm to individuals in the United Kingdom, and the order is 
proportionate to the risk of such harm, 

(d) inthe case of an application made on the ground in subsection (3)(c)(iii) 
or (iv), that it is appropriate to make the order before a provisional 
notice of enforcement action or confirmation decision has been given, 
or before compliance with a confirmation decision has been ascertained 
(as the case may be), and 

(e) if no notice of the application has been given to the non-compliant 
provider, or to the persons on whom requirements are being imposed, 
that it is appropriate to make the order without notice. 


(7) When considering whether to make a service restriction order in relation to the 
relevant service, and when considering what provision it should contain, the 
court must take into account (amongst other things) the rights and obligations 
of all relevant parties, including those of — 

(a) the non-compliant provider, 

(b) the person or persons on whom the court is considering imposing the 
requirements, and 

(c) United Kingdom users of the relevant service. 


(8) A service restriction order made in relation to the relevant service must — 
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identify the non-compliant provider, 

identify the persons on whom the requirements are imposed, and any 
ancillary service to which the requirements relate, 

require such persons to take the steps specified in the order, or to put in 
place arrangements, that have the effect of withdrawing the ancillary 
service to the extent that it relates to the relevant service (or part of it), 
or preventing the ancillary service from promoting or displaying 
content that relates to the relevant service (or part of it) in any way, 
specify the date by which the requirements in the order must be 
complied with, and 

specify the date on which the order expires, or the time period for 
which the order has effect. 


(9) The steps that may be specified or arrangements that may be required to be put 
in place— 


(a) 


(b) 


include steps or arrangements that will or may require the termination 
of an agreement (whether or not made before the coming into force of 
this section), or the prohibition of the performance of such an 
agreement, and 

are limited, so far as that is possible, to steps or arrangements relating 
to the operation of the relevant service as it affects United Kingdom 
users. 


(10) OFCOM must inform the Secretary of State as soon as reasonably practicable 
after a service restriction order has been made. 


(11) For the purposes of this section, a service is an “ancillary service” in relation to 
a regulated service if the service facilitates the provision of the regulated 
service (or part of it), whether directly or indirectly, or displays or promotes 
content relating to the regulated service (or to part of it). 


(12) Examples of ancillary services include — 


(a) 


services, provided (directly or indirectly) in the course of a business, 
which enable funds to be transferred in relation to a regulated service, 
search engines which generate search results displaying or promoting 
content relating to a regulated service, 

user-to-user services which make content relating to a regulated service 
available to users, and 

services which use technology to facilitate the display of advertising on 
a regulated service (for example, an ad server or an ad network). 


(13) In this section “the court” means — 


(a) 
(b) 
(c) 


in England and Wales, the High Court or the county court, 
in Scotland, the Court of Session or a sheriff, and 
in Northern Ireland, the High Court or a county court. 


92 Interim service restriction orders 


(1) OFCOM may apply to the court for an interim order under this section (an 
“interim service restriction order”) in relation to a regulated service where 
OFCOM consider that— 


(a) 
(b) 


the grounds in subsection (3) apply in relation to the service, or 
the grounds in subsection (4) apply in relation to the service. 
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(2) An interim service restriction order is an interim order imposing requirements 
on one or more persons who provide an ancillary service in relation to a 
regulated service (see subsection (9)). 


(3) The grounds mentioned in subsection (1)(a) are that — 

(a) itis likely that the provider of the regulated service is failing to comply 5 
with an enforceable requirement referred to in section 82 that applies in 
relation to the regulated service, and 

(b) the level of risk of harm to individuals in the United Kingdom relating 
to the likely failure, and the nature and severity of that harm, are such 
that it would not be appropriate to wait to establish the failure before 10 
applying for the order. 


(4) The grounds mentioned in subsection (1)(b) are that — 
(a) itis likely that the provider of the regulated service is failing to comply 
with a use of technology notice under section 64, 65 or 67 that relates to 
the service, and 15 
(b) the level of risk of harm to individuals in the United Kingdom relating 
to the likely failure, and the nature and severity of that harm, are such 
that it would not be appropriate to wait to establish the failure before 
applying for the order. 


(5) An application by OFCOM for an interim service restriction order must — 20 
(a) specify the regulated service in relation to which the application is 
made (“the relevant service”), 
(b) specify the provider of that service (“the non-compliant provider”), 
(c) specify the grounds on which the application is based, and contain 
evidence as to such grounds, 25 
(d) specify the persons on whom (in OFCOM’s opinion) the requirements 
of the order should be imposed, 
(e) contain evidence as to why OFCOM consider that the persons 
mentioned in paragraph (d) provide an ancillary service in relation to 
the relevant service, and specify any such ancillary service provided, 30 
(f) specify the requirements which OFCOM consider that the order should 
impose on such persons, and 
(g) inthe case of an application made without notice having been given to 
the non-compliant provider, or to the persons mentioned in paragraph 
(d), state why no notice has been given. 35 


(6) The court may make an interim service restriction order imposing 
requirements on a person in relation to the relevant service if the court is 


satisfied — 
(a) as to the ground in subsection (3)(a) or the ground in subsection (4)(a) 
(as the case may be), 40 
(b) that the person provides an ancillary service in relation to the relevant 
service, 


(c) that there are prima facie grounds to suggest that an application for a 
service restriction order under section 91 would be successful, 

(d) that the level of risk of harm to individuals in the United Kingdom 45 
relating to the likely failure mentioned in subsection (3)(a) or (4)(a) 
(whichever applies), and the nature and severity of that harm, are such 
that it is not appropriate to wait for the failure to be established before 
making the order, and 
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(e) if no notice of the application has been given to the non-compliant 
provider, or to the persons on whom requirements are being imposed, 
that it is appropriate to make the order without notice. 


(7) An interim service restriction order ceases to have effect on the earlier of — 
(a) the date specified in the order, or the date on which the time period 
specified in the order expires (as the case may be), or 
(b) the date on which the court makes a service restriction order under 
section 91 in relation to the relevant service that imposes requirements 
on the same persons on whom requirements are imposed by the 
interim order, or dismisses the application for such an order. 


(8) Subsections (7) to (10) of section 91 apply in relation to an interim service 
restriction order under this section as they apply in relation to a service 
restriction order under that section. 


(9) In this section, “ancillary service” and “the court” have the same meaning as in 
section 91 (see subsections (11), (12) and (13) of that section). 
93 Access restriction orders 


(1) OFCOM may apply to the court for an order under this section (an “access 
restriction order’) in relation to a regulated service where OFCOM consider 


that — 
(a) the grounds in section 91(3) or (4) apply in relation to the service, and 
(b) either— 


(i) aservice restriction order under section 91 or an interim service 
restriction order under section 92 has been made in relation to 
the failure, and it was not sufficient to prevent significant harm 
arising to individuals in the United Kingdom as a result of the 
failure, or 

(ii) the likely consequences of the failure are such that if a service 
restriction order or an interim service restriction order were to 
be made, it would be unlikely to be sufficient to prevent 
significant harm arising to individuals in the United Kingdom 
as a result of the failure, 

and in this paragraph, “the failure” means the failure mentioned in 
section 91(3)(a) or (4)(a) (as the case may be). 


(2) An access restriction order is an order imposing requirements on one or more 
persons who provide an access facility in relation to a regulated service (see 
subsection (10)). 


(3) An application by OFCOM for an access restriction order must — 

(a) specify the regulated service in relation to which the application is 
made (“the relevant service”), 

(b) specify the provider of that service (“the non-compliant provider’), 

(c) specify the grounds on which the application is based, and contain 
evidence as to such grounds, 

(d) specify the persons on whom (in OFCOM’s opinion) the requirements 
of the order should be imposed, 

(e) contain evidence as to why OFCOM consider that the persons 
mentioned in paragraph (d) provide an access facility in relation to the 
relevant service, and specify any such access facility provided, 
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(f) specify the requirements which OFCOM consider that the order should 
impose on such persons, and 

(g) inthe case of an application made without notice having been given to 
the non-compliant provider, or to the persons mentioned in paragraph 
(d), state why no notice has been given. 


(4) The court may make an access restriction order imposing requirements on a 
person in relation to the relevant service if the court is satisfied — 

(a) as to the grounds in subsection (1), 

(b) that the person provides an access facility in relation to the relevant 
service, 

(c) that it is appropriate to make the order for the purposes of preventing 
significant harm to individuals in the United Kingdom, and the order 
is proportionate to the risk of such harm, 

(d) inthe case of an application made on the ground in subsection (3)(c)(iii) 
or (iv) of section 91 (by virtue of subsection (1)(a)), that it is appropriate 
to make the order before a provisional notice of enforcement action or 
confirmation decision has been given, or before compliance with a 
confirmation decision has been ascertained (as the case may be), and 

(e) if no notice of the application has been given to the non-compliant 
provider, or to the persons on whom requirements are being imposed, 
that it is appropriate to make the order without notice. 


(5) When considering whether to make an access restriction order in relation to the 
relevant service, and when considering what provision it should contain, the 
court must take into account (amongst other things) the rights and obligations 
of all relevant parties, including those of — 

(a) the non-compliant provider, 

(b) the person or persons on whom the court is considering imposing the 
requirements, and 

(c) United Kingdom users of the relevant service. 


(6) An access restriction order made in relation to the relevant service must — 

(a) identify the non-compliant provider, 

(b) identify the persons on whom the requirements are imposed, and any 
access facility to which the requirements relate, 

(c) require such persons to take the steps specified in the order, or to put in 
place arrangements, to withdraw, adapt or manipulate the access 
facility in order to impede users’ access (by means of that facility) to the 
relevant service (or to part of it), 

(d) specify the date by which the requirements in the order must be 
complied with, and 

(e) specify the date on which the order expires, or the time period for 
which the order has effect. 


(7) The steps that may be specified or arrangements that may be required to be put 
in place — 

(a) include steps or arrangements that will or may require the termination 
of an agreement (whether or not made before the coming into force of 
this section), or the prohibition of the performance of such an 
agreement, 

(b) are limited, so far as that is possible, to steps or arrangements that 
impede the access of United Kingdom users, and 
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(c) are limited, so far as that is possible, to steps or arrangements that do 
not affect such users’ ability to access any other internet services. 


(8) OFCOM must inform the Secretary of State as soon as reasonably practicable 
after an access restriction order has been made. 


(9) Where a person who provides an access facility takes steps or puts in place 
arrangements required by an access restriction order, OFCOM may, by notice, 
require that person to (where possible) notify persons in the United Kingdom 
who attempt to access the relevant service via that facility of the access 
restriction order (and where a confirmation decision has been given to the non- 
compliant provider, the notification must refer to that decision). 


(10) For the purposes of this section, a facility is an “access facility” in relation to a 
regulated service if the person who provides the facility is able to withdraw, 
adapt or manipulate it in such a way as to impede access (by means of that 
facility) to the regulated service (or to part of it) by United Kingdom users of 
that service. 


(11) Examples of access facilities include — 


(a) internet access services by means of which a regulated service is made 
available, and 


(b) application stores through which a mobile application for a regulated 
service may be downloaded or otherwise accessed. 


(12) In this section— 
“the court” means — 
(a) in England and Wales, the High Court or the county court, 
(b) in Scotland, the Court of Session or a sheriff, and 
(c) in Northern Ireland, the High Court or a county court; 


“facility” means any kind of service, infrastructure or apparatus enabling 
users of a regulated service to access the regulated service; 


“internet access service” means a service that provides access to virtually 
all (or just some) of the end points of the internet. 
94 Interim access restriction orders 


(1) OFCOM may apply to the court for an interim order under this section (an 
“interim access restriction order”) in relation to a regulated service where 


OFCOM consider that— 
(a) the grounds in section 92(3) or (4) apply in relation to the service, and 
(b) either— 


(i) aservice restriction order under section 91 or an interim service 
restriction order under section 92 has been made in relation to 
the likely failure, and it was not sufficient to prevent significant 
harm arising to individuals in the United Kingdom as a result 
of the failure, or 

(ii) the likely consequences of such a failure would be such that if a 
service restriction order or an interim service restriction order 
were to be made, it would be unlikely to be sufficient to prevent 
significant harm arising to individuals in the United Kingdom 
as a result of the failure, 

and in this section, “the likely failure’ means the likely failure 
mentioned in section 92(3)(a) or (4)(a) (as the case may be). 
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(2) 


(3) 


(4) 


An interim access restriction order is an interim order imposing requirements 
on one or more persons who provide an access facility in relation to a regulated 
service (see subsection (8)). 


An application by OFCOM for an interim access restriction order must — 

(a) specify the regulated service in relation to which the application is 
made (“the relevant service”), 

(b) specify the provider of that service (“the non-compliant provider”), 

(c) specify the grounds on which the application is based, and contain 
evidence as to such grounds, 

(d) specify the persons on whom (in OFCOM’s opinion) the requirements 
of the order should be imposed, 

(e) contain evidence as to why OFCOM consider that the persons 
mentioned in paragraph (d) provide an access facility in relation to the 
relevant service, and specify any such access facility provided, 

(f) specify the requirements which OFCOM consider that the order should 
impose on such persons, and 

(g) inthe case of an application made without notice having been given to 
the non-compliant provider, or to the persons mentioned in paragraph 
(d), state why no notice has been given. 


The court may make an interim access restriction order imposing requirements 
on a person in relation to the relevant service if the court is satisfied — 

(a) that the ground in section 92(3)(a) or (4)(a) (as the case may be) applies 
in relation to the service, 

(b) as to the ground in subsection (1)(b)(i) or (ii), 

(c) that the person provides an access facility in relation to the relevant 
service, 

(d) that there are prima facie grounds to suggest that an application for an 
access restriction order under section 93 would be successful, 

(e) that the level of risk of harm to individuals in the United Kingdom 
relating to the likely failure, and the nature and severity of that harm, 
are such that it is not appropriate to wait for the failure to be established 
before making the order, and 

(f) if no notice of the application has been given to the non-compliant 
provider, or to the persons on whom requirements are being imposed, 
that it is appropriate to make the order without notice. 


An interim access restriction order ceases to have effect on the earlier of — 
(a) the date specified in the order, or the date on which the time period 
specified in the order expires (as the case may be), or 
(b) the date on which the court makes an access restriction order under 
section 93 in relation to the relevant service that imposes requirements 
on the same persons on whom requirements are imposed by the 
interim order, or dismisses an application for such an order. 


Subsections (5) to (8) of section 93 apply in relation to an interim access 
restriction order under this section as they apply in relation to an access 
restriction order under that section. 


Where a person who provides an access facility takes steps or puts in place 
arrangements required by an interim access restriction order, OFCOM may, by 
notice, require that person to (where possible) notify persons in the United 
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Kingdom who attempt to access the relevant service via that facility of the 
interim access restriction order. 


(8) In this section, “access facility” and “the court” have the same meaning as in 
section 93 (see subsections (10), (11) and (12) of that section). 


95 Interaction with other action by OFCOM 


(1) Where OFCOM apply for a business disruption order in respect of a failure by 
a provider of a regulated service to comply with an enforceable requirement 
referred to in section 82, nothing in sections 91 to 94 is to be taken to prevent 
OFCOM also giving the provider — 


(a) aconfirmation decision in respect of the failure, or 


(b) a penalty notice under section 84(3) in relation to a confirmation 
decision in respect of the failure. 


(2) Where OFCOM apply for a business disruption order in respect of a failure by 
a provider of a regulated service to comply with a use of technology notice 
under section 64, 65 or 67, nothing in sections 91 to 94 is to be taken to prevent 
OFCOM also giving the provider a further use of technology notice under 
section 67. 


(3) In this section, a “business disruption order” means — 
(a) a service restriction order under section 91, 
(b) aninterim service restriction order under section 92, 
(c) an access restriction order under section 93, or 
(d) aninterim access restriction order under section 94. 


Publication of enforcement action 


96 Publication of details of enforcement action 


(1) Subsections (2) and (3) apply where OFCOM have taken any of the following 
kinds of enforcement action in relation to a person— 
(a) given a confirmation decision; 
(b) given a penalty notice under section 84(3); 
(c) given a penalty notice under section 89; 
(d) given a penalty notice under section 90. 


2) OFCOM must publish details identifying the person and describing — 
P ying tne p 8 
(a) the action that has been taken, and 
(b) the failure (or failures) to which that action relates. 


3) But OFCOM may not publish anything that, in OFCOM’s opinion — 
y Dorp yuung P 
(a) is commercially sensitive, or 
(b) is otherwise not appropriate for publication. 


(4) Where OFCOM have given a person a provisional notice of enforcement action 
but have taken no enforcement action against the person, OFCOM may publish 
details identifying the person and describing the reasons for the provisional 
notice. 


5) OFCOM must notify the person concerned that information has been 
y P 
published under this section. 
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(6) 


97 
(1) 


(2) 


98 
(1) 


Publication under this section may be in any manner that OFCOM consider 
appropriate. 


Guidance 


Guidance about enforcement action 


OFCOM must prepare guidance about how OFCOM propose to exercise their 
functions under this Chapter. 


The guidance must, in particular, give information about the factors that 
OFCOM would consider it appropriate to take into account when taking, or 
considering taking, enforcement action relating to a person’s failure to comply 
with the enforceable requirements referred to in each paragraph of section 82. 


In relation to any enforcement action by OFCOM which relates to a failure by 
a provider of a regulated service to comply with a relevant duty, the guidance 
must include provision explaining how OFCOM will take into account the 
impact (or possible impact) of such a failure on children. 


Before preparing guidance under this section (including revised or 
replacement guidance), OFCOM must consult — 

(a) the Secretary of State, and 

(b) such other persons as OFCOM consider appropriate. 


OFCOM must publish the guidance (and any revised or replacement 
guidance). 


Guidelines prepared by OFCOM under section 392 of the Communications Act 
(amount of penalties) may, so far as relating to penalties imposed under this 
Chapter, be included in the same document as guidance under this section. 


In exercising their functions under this Chapter, or deciding whether to 
exercise them, OFCOM must have regard to the guidance for the time being in 
force under this section. 


In this section, a “relevant duty” means — 
(a) aduty under section 9 or 21 (safety duties about illegal content), or 


(b) a duty under section 10 or 22 (safety duties for services likely to be 
accessed by children). 


CHAPTER 7 


COMMITTEES, RESEARCH AND REPORTS 


Advisory committee on disinformation and misinformation 


OFCOM must, in accordance with the following provisions of this section, 
exercise their powers under paragraph 14 of the Schedule to the Office of 
Communications Act 2002 (committees of OFCOM) to establish and maintain 
a committee to provide the advice specified in this section. 


The committee is to consist of — 
(a) achairman appointed by OFCOM, and 
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(b) such number of other members appointed by OFCOM as OFCOM 
think fit. 


(3) In appointing persons to be members of the committee, OFCOM must have 
regard to the desirability of ensuring that the members of the committee 
include — 

(a) persons representing the interests of United Kingdom users of 
regulated services, 
(b) persons representing providers of regulated services, and 


(c) persons with expertise in the prevention and handling of 
disinformation and misinformation online. 


(4) The function of the committee is to provide advice to OFCOM (including other 
committees established by OFCOM) about — 


(a) how providers of regulated services should deal with— 

(i) in the case of regulated user-to-user services, disinformation 
and misinformation present on such services, and 

(ii) in the case of regulated search services, disinformation and 
misinformation that may be encountered in or via search 
results; 

(b) OFCOM’s exercise of their power under section 49 to require 
information of a kind mentioned in subsection (4) of that section, so far 
as relating to disinformation and misinformation; and 

(c) OFCOM?’s exercise of their functions under section 11 of the 
Communications Act (duty to promote media literacy) in relation to 
countering disinformation and misinformation online. 


(5) The committee must publish a report within the period of 18 months after 
being established, and after that must publish periodic reports. 


99 Research about users’ experiences of regulated services 


(1) Section 14 of the Communications Act (consumer research) is amended as 
follows. 


(2) After subsection (6A) insert — 


“(6B) OFCOM must make arrangements for ascertaining — 

(a) the state of public opinion from time to time concerning 
providers of regulated services and their manner of operating 
their services; 

(b) the experiences of United Kingdom users of regulated services 
in relation to their use of such services; 

(c) the experiences of such users of regulated services in relation to 
the handling of complaints made by them to providers of such 
services; and 

(d) the interests and experiences of such users of regulated services 
in relation to matters that are incidental to or otherwise 
connected with their experiences of using such services. 


(6C) OFCOM’s report under paragraph 12 of the Schedule to the Office of 
Communications Act 2002 for each financial year must contain a 
statement by OFCOM about the research that has been carried out in 
that year under subsection (6B).” 
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(3) After subsection (8) insert — 


“(8A) In subsection (6B) the following terms have the same meaning as in the 
Online Safety Act 2021 — 
“regulated service” (see section 3 of that Act); 
“provider” (see section 116 of that Act); 
“United Kingdom user” (see section 122 of that Act).” 


100 OFCOM’s transparency reports 


(1) OFCOM must produce transparency reports based on information contained 
in the transparency reports produced by providers of regulated services under 
section 49. 


(2) OFCOM’s transparency reports must contain — 

(a) a summary of conclusions drawn from the transparency reports 
produced under section 49 regarding patterns or trends which OFCOM 
have identified in such reports, 

(b) a summary of steps mentioned in such transparency reports which 
OFCOM consider to be good industry practice, and 

(c) any other information from such transparency reports which OFCOM 
consider it appropriate to include. 


(3) OFCOM’: first transparency report must be published by the end of the period 
of one year beginning with the day on which the first report under section 49 
is published by a provider of a regulated service (see subsection (1)(d) of that 
section), and OFCOM must publish a report at least once a year after that. 


(4) OFCOM must publish their transparency reports in such manner as they 
consider appropriate. 


(5) For further provision about reports under this section, see section 102. 


101 OFCOM?’s report about researchers’ access to information 


(1) OFCOM must prepare a report — 

(a) describing how, and to what extent, persons carrying out independent 
research into online safety matters are currently able to obtain 
information from providers of regulated services to inform their 
research, 

(b) exploring the legal and other issues which currently constrain the 
sharing of information for such purposes, and 

(c) assessing the extent to which greater access to information for such 
purposes might be achieved. 


(2) For the purposes of this section a person carries out “independent research” if 
the person carries out research on behalf of a person other than a provider of a 
regulated service. 


(3) In preparing the report, OFCOM must consult — 
(a) the Information Commissioner, 
(b) the Centre for Data Ethics and Innovation, 
(c) United Kingdom Research and Innovation, 
(d) persons who appear to OFCOM to have relevant expertise, 
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(e) persons who appear to OFCOM to represent providers of regulated 
services, and 


(f) such other persons as OFCOM consider appropriate. 


OFCOM must publish the report within the period of two years beginning with 
the day on which this section comes into force. 


The publication of the report must be in such manner as OFCOM consider 
appropriate. 


OFCOM must send a copy of the report to the Secretary of State, and the 
Secretary of State must lay it before Parliament. 


For further provision about the report under this section, see section 102. 


Following the publication of the report, OFCOM may prepare guidance about 
the matters dealt with by the report for providers of regulated services and 
persons carrying out independent research into online safety matters. 


If OFCOM decide to prepare such guidance, they must — 
(a) consult persons as mentioned in subsection (3), 
(b) publish the guidance (and any revised guidance), and 
(c) include in each transparency report under section 100 an assessment of 
the effectiveness of the guidance. 


Subsection (9)(a) also applies if OFCOM decide to revise guidance under this 
section. 


102 Reports by OFCOM 


(1) 
(2) 


OFCOM may from time to time produce and publish reports about online 
safety matters. 


In publishing a report mentioned in subsection (5), OFCOM must have regard 
to the need to exclude from publication, so far as that is practicable, the matters 
which are confidential in accordance with subsections (3) and (4). 


A matter is confidential under this subsection if — 
(a) it relates specifically to the affairs of a particular body, and 


(b) publication of that matter would or might, in OFCOM’s opinion, 
seriously and prejudicially affect the interests of that body. 


A matter is confidential under this subsection if — 
(a) it relates to the private affairs of an individual, and 


(b) publication of that matter would or might, in OFCOM’s opinion, 
seriously and prejudicially affect the interests of that individual. 


The reports referred to in subsection (2) are— 
(a) areport under section 69 (report about use of technology), 
(b) areport under section 100 (transparency report), 
(c) a report under section 101 (report about researchers’ access to 
information), and 


(d) areport produced under this section. 
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103 Media literacy 


CHAPTER 8 


MEDIA LITERACY 


For section 11 of the Communications Act (duty to promote media literacy) 


substitute — 


“11 Duty to promote media literacy 


(1) OFCOM must take such steps as they consider appropriate — 


(a) 
(b) 


to improve the media literacy of members of the public, and 
in relation to material published by means of the electronic 
media, to encourage the development and use of technologies 
and systems which help to improve the media literacy of 
members of the public, including in particular technologies and 
systems which — 
(i) indicate the nature of the material (for example, show 
where it is an advertisement), 
(ii) indicate the reliability and accuracy of the material, and 
(iii) facilitate control over what material is received. 


(2) In this section “media literacy” means — 


(a) 


(e) 


an understanding of the nature and characteristics of material 
published by means of the electronic media, 
an awareness of the impact that such material may have (for 
example, the impact on the behaviour of those who receive it), 
an awareness and understanding of the processes by which 
such material is selected or made available for publication, 
an awareness of the available systems by which — 

(i) the nature of such material may be established, 


(ii) the reliability and accuracy of such material may be 
established, 


(iii) personal information may be protected, and 
(iv) persons to whom such material is made available may 
control what is received, and 
an awareness of the uses to which systems mentioned in 
paragraph (d) may be put. 


3) In performing their duty under subsection (1)(a) OFCOM must, in 
P 8 y 
particular, carry out, commission or encourage educational initiatives 
designed to improve the media literacy of members of the public. 


(4) OFCOM must prepare guidance — 


about the evaluation of educational initiatives mentioned in 
subsection (3) by persons providing them, 

about the evaluation, by providers of regulated services, of any 
actions taken by them in relation to those services to improve 
the media literacy of members of the public, and 

about the evaluation, by persons developing or using 
technologies and systems mentioned in subsection (1)(b), of the 
effectiveness of those technologies and systems in improving 
the media literacy of members of the public. 
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(5) OFCOM must keep the guidance under review. 


(6) OFCOM must publish the guidance (and any revised or replacement 
guidance). 

(7) For OFCOM’s duty to carry out research into the matters mentioned in 
subsection (1), see section 14(6)(a). 


(8) Every report under paragraph 12 of the Schedule to the Office of 
Communications Act 2002 (OFCOM’s annual report) for a financial 
year must contain a summary of the steps that OFCOM have taken 
under subsection (1) in that year. 


(9) In this section— 
(a) “provider”, in relation to a regulated service, has the same 
meaning as in the Online Safety Act 2021 (see section 116); 
(b) “regulated service” has the same meaning as in the Online 
Safety Act 2021 (see section 3(2) of that Act); and 
(c) references to the publication of anything by means of the 
electronic media are references to its being — 
(i) broadcast so as to be available for reception by members 
of the public or of a section of the public, or 
(ii) distributed by means of an electronic communications 
network to members of the public or of a section of the 
public.” 


PART 5 
APPEALS AND SUPER-COMPLAINTS 
CHAPTER 1 


APPEALS 


104 Appeals against OFCOM decisions relating to the register under section 59 


(1) This section applies to the following decisions of OFCOM — 

(a) a decision to include a regulated user-to-user service in the part of the 
register referred to in section 59(1)(a)(i) (Category 1 services); 

(b) a decision not to remove a regulated user-to-user service from that part 
of the register; 

(c) adecision to include a regulated search service in the part of the register 
referred to in section 59(1)(a)(ii) (Category 2A services); 

(d) adecision not to remove a regulated search service from that part of the 
register; 

(e) a decision to include a regulated user-to-user service in the part of the 
register referred to in section 59(1)(a) (iii) (Category 2B services); 

(f) a decision not to remove a regulated user-to-user service from that part 
of the register. 


(2) The provider of the service to which the decision relates may appeal to the 
Upper Tribunal against the decision. 
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(3) Where an appeal is made under subsection (1)(a), (c) or (e), any special 
requirements need not be complied with until the determination or 
withdrawal of the appeal. 


(4) “Special requirement” means — 

(a) in the case of an appeal against a decision mentioned in subsection 
(1)(a)— 

(i) any requirement of this Act that applies in relation to Category 
1 services but not in relation to any other regulated services, or 

(ii) any requirement of this Act that applies in relation to Category 
1 services, Category 2A services and Category 2B services but 
not in relation to any other regulated services; 

(b) in the case of an appeal against a decision mentioned in subsection 
(1)(c) or (e), any requirement of this Act that applies in relation to 
Category 1 services, Category 2A services and Category 2B services but 
not in relation to any other regulated services. 


(5) The Upper Tribunal must decide the appeal by applying the same principles as 
would be applied — 
(a) by the High Court on an application for judicial review, or 


(b) in Scotland, on an application to the supervisory jurisdiction of the 
Court of Session. 


(6) Onan appeal under this section, the Upper Tribunal may — 
(a) dismiss the appeal, or 
(b) quash the decision being challenged. 


(7) Where a decision is quashed, the Upper Tribunal must remit the decision to 
OFCOM for reconsideration with such directions (if any) as the Tribunal 
considers appropriate. 


105 Appeals against OFCOM notices 


(1) A person who is given a use of technology notice under section 64, 65 or 67 may 
appeal to the Upper Tribunal against OFCOM’s decision to give the notice. 


(2) An appeal to the Upper Tribunal against OFCOM’s decision to give — 
(a) aconfirmation decision to a person, or 
(b) a penalty notice to a person, 
may be brought by any person with a sufficient interest in the decision. 


(3) An appeal under subsection (2) by a person other than the person given the 
confirmation decision or penalty notice in question may be brought only with 
the permission (or, in Northern Ireland, leave) of the Upper Tribunal. 


(4) The Upper Tribunal must decide the appeal by applying the same principles as 
would be applied — 
(a) by the High Court on an application for judicial review, or 


(b) in Scotland, on an application to the supervisory jurisdiction of the 
Court of Session. 


(5) Onan appeal under this section, the Upper Tribunal may — 
(a) dismiss the appeal, or 
(b) quash the decision being challenged. 
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Where a decision is quashed, the Upper Tribunal must remit the decision to 
OFCOM for reconsideration with such directions (if any) as the Tribunal 
considers appropriate. 


In this section “penalty notice” means a penalty notice under section 84(3), 89 
or 90. 


CHAPTER 2 


SUPER-COMPLAINTS 


106 Power to make super-complaints 


(1) 


An eligible entity may make a complaint to OFCOM that any feature of one or 
more regulated services, or any conduct of one or more providers of such 
services, or any combination of such features and such conduct is, appears to 
be, or presents a material risk of — 

(a) causing significant harm to users of the services or members of the 
public, or a particular group of such users or members of the public; 

(b) significantly adversely affecting the rights to freedom of expression 
within the law of users of the services or members of the public, or of a 
particular group of such users or members of the public; 

(c) causing significant unwarranted infringements of privacy, in relation 
to users of the services or members of the public, or a particular group 
of such users or members of the public; or 

(d) otherwise having a significant adverse impact on users of the services 
or members of the public, or on a particular group of such users or 
members of the public. 


But an eligible entity may only make a complaint under subsection (1) that 
relates to a single regulated service or that relates to a single provider of one or 
more regulated services if OFCOM consider that — 


(a) the complaint is of particular importance, or 


(b) the complaint relates to impacts on a particularly large number of users 
of the service or members of the public. 


An entity is an “eligible entity” if the entity meets criteria specified in 
regulations made by the Secretary of State. 


Regulations under subsection (3) must specify as one of the criteria that the 
entity must be a body representing the interests of users of regulated services, 
or members of the public, or a particular group of such users or members of the 
public. 


Before making regulations under subsection (3), the Secretary of State must 
consult — 


(a) OFCOM, and 
(b) such other persons as the Secretary of State considers appropriate. 


In this section — 
(a) “conduct” includes acts and omissions, and 
(b) “user” means United Kingdom user (see section 122). 
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107 Super-complaints: procedure 


(1) The Secretary of State must make regulations containing provision about 
procedural matters relating to complaints under section 106. 


(2) Such regulations may, in particular, include provision about the following 
matters — 
(a) notification to OFCOM of an intention to make a complaint under 
section 106; 


(b) the form and manner of such a complaint, including requirements for 
supporting evidence in relation to — 


(i) matters mentioned in subsections (1) and (2) of section 106, and 


(ii) criteria specified in regulations under subsection (3) of that 
section; 


(c) steps that OFCOM must take in relation to such a complaint, including 
requirements for publication of responses; 


(d) time limits for taking steps in relation to such a complaint (or provision 
about how such time limits are to be determined) including time limits 
in relation to the determination of — 


(i) whether acomplaint is a complaint that is within section 106(1), 
(and where applicable, within section 106(2)), and 


(ii) whether an entity is an eligible entity (see section 106(3)). 


(3) Before making regulations under subsection (1), the Secretary of State must 
consult — 


(a) OFCOM, and 
(b) such other persons as the Secretary of State considers appropriate. 


108 Super-complaints: guidance 


(1) OFCOM must prepare guidance about complaints under section 106, which 
must include — 
(a) guidance about the criteria specified in regulations under section 
106(3), 
(b) guidance about procedural matters relating to complaints under 
section 106, and 


(c) guidance about any other aspect of complaints under section 106 that 
OFCOM consider it appropriate to include. 


(2) OFCOM must publish the guidance (and any revised or replacement 
guidance). 


PART 6 


SECRETARY OF STATE'S FUNCTIONS IN RELATION TO REGULATED SERVICES 
Strategic priorities 


109 Statement of strategic priorities 


(1) The Secretary of State may designate a statement for the purposes of this 
section if the requirements set out in section 110 (consultation and 
parliamentary procedure) are satisfied. 


10 


20 


25 


30 


35 


40 


98 


Online Safety Bill 
Part 6 — Secretary of State's functions in relation to regulated services 


The statement is a statement prepared by the Secretary of State that sets out 
strategic priorities of Her Majesty’s Government in the United Kingdom 
relating to online safety matters. 


The statement may, among other things, set out particular outcomes identified 
with a view to achieving the strategic priorities. 


This section does not restrict the Secretary of State’s powers under any other 
provision of this Act or any other enactment. 


A statement designated under subsection (1) must be published in such 
manner as the Secretary of State considers appropriate. 


A statement designated under subsection (1) may be amended (including by 
replacing the whole or a part of the statement with new material) by a 
subsequent statement designated under that subsection, and this section and 
sections 57 and 110 apply in relation to any such subsequent statement as they 
apply in relation to the original statement. 


Except as provided by subsection (8), no amendment may be made under 
subsection (6) within the period of five years beginning with the day on which 
a statement was most recently designated under subsection (1). 


An earlier amendment may be made under subsection (6) if — 
(a) since that day — 
(i) a Parliamentary general election has taken place, or 
(ii) there has been a significant change in the policy of Her 
Majesty’s government affecting online safety matters, or 
(b) the Secretary of State considers that the statement, or any part of it, 
conflicts with any of OFCOM’s general duties (within the meaning of 
section 3 of the Communications Act). 


Consultation and parliamentary procedure 


This section sets out the requirements that must be satisfied in relation to a 
statement before the Secretary of State may designate it under section 109. 


The Secretary of State must consult — 

(a) OFCOM, and 

(b) such other persons as the Secretary of State considers appropriate, 
on a draft of the statement. 


The Secretary of State must allow OFCOM a period of at least 40 days to 
respond to any consultation under subsection (2)(a). 


After that period has ended the Secretary of State — 
(a) must make any changes to the draft that appear to the Secretary of State 
to be necessary in view of responses to the consultation, and 
(b) must then lay the draft before Parliament. 


The Secretary of State must then wait until the end of the 40-day period and 
may not designate the statement if, within that period, either House of 
Parliament resolves not to approve it. 


“The 40-day period” is the period of 40 days beginning with the day on which 
the draft is laid before Parliament (or, if it is not laid before each House on the 
same day, the later of the days on which it is laid). 
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(7) 


111 
(1) 


(2) 


(5) 
112 
(1) 


When calculating the 40-day period, any period during which Parliament is 
dissolved or prorogued or during which both Houses are adjourned for more 
than 4 days is to be ignored. 


Directions to OFCOM 


Secretary of State directions about advisory committees 


The Secretary of State may give OFCOM a direction requiring OFCOM to 
establish a committee to provide advice to OFCOM about online safety matters 
of a kind specified in the direction. 


The Secretary of State must consult OFCOM before giving a direction under 
this section. 


A committee required to be established by a direction under this section is to 
consist of the following members, unless the direction specifies otherwise — 
(a) achairman appointed by OFCOM, and 
(b) such number of other members appointed by OFCOM as OFCOM 
think fit. 


A committee required to be established by a direction under this section must, 
unless the direction specifies otherwise, publish a report within the period of 
18 months after being established, and after that must publish periodic reports. 


The Secretary of State may vary or revoke a direction given under this section. 


Secretary of State directions in special circumstances 


The Secretary of State may give a direction to OFCOM under subsection (2) or 
(3) if the Secretary of State has reasonable grounds for believing that 
circumstances exist that present a threat — 

(a) to the health or safety of the public, or 

(b) to national security. 


A direction under this subsection is a direction requiring OFCOM, in 
exercising their media literacy functions, to give priority for a specified period 
to specified objectives designed to address the threat presented by the 
circumstances mentioned in subsection (1). 


A direction under this subsection is a direction requiring OFCOM to give a 
public statement notice to— 

(a) a specified provider of a regulated service, or 

(b) providers of regulated services generally. 


A “public statement notice” is a notice requiring a provider of a regulated 
service to make a publicly available statement, by a date specified in the notice, 
about steps the provider is taking in response to the threat presented by the 
circumstances mentioned in subsection (1). 


OFCOM may, by a public statement notice or a subsequent notice, require a 
provider of a regulated service to provide OFCOM with such information as 
OFCOM may require for the purpose of responding to that threat. 
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(10) 


113 
(1) 


If a direction under subsection (2) or (3) is given on the ground mentioned in 
subsection (1)(a), the Secretary of State must publish the reasons for giving the 
direction. 


The Secretary of State may vary or revoke a direction given under subsection 
(2) or (3). 


If the Secretary of State varies or revokes a direction given under subsection (3), 
OFCOM may, in consequence, vary or revoke a public statement notice that 
they have given by virtue of the direction. 


In subsection (2) “media literacy functions” means OFCOM’s functions under 
section 11 of the Communications Act (duty to promote media literacy), so far 
as functions under that section relate to regulated services. 


In subsections (2) and (3) “specified” means specified in the direction. 
Guidance 


Secretary of State guidance 


The Secretary of State may give guidance to OFCOM about — 

(a) OFCOM’s exercise of their functions under this Act, 

(b) OFCOM’s exercise of their powers under section 1(3) of the 
Communications Act (functions and general powers of OFCOM) to 
carry out research in connection with online safety matters or to 
arrange for others to carry out research in connection with such 
matters, and 

(c) OFCOM’s exercise of their functions under section 11 of the 
Communications Act (media literacy). 


In subsections (3) to (8) “the guidance” means any such guidance as is 
mentioned in subsection (1), except that — 
(a) it does not include guidance under section 54 (guidance to OFCOM 
about fees), and 
(b) it does not include any guidance mentioned in subsection (1)(c) if such 
guidance includes provision about OFCOM’s media literacy functions 
in relation to services other than regulated services. 


The Secretary of State must consult OFCOM before issuing, revising or 
replacing the guidance. 


The guidance may not be revised or replaced more frequently than once every 
three years unless — 

(a) the guidance needs to be corrected because of an amendment, repeal or 
modification of any provision of this Act or of section 11 of the 
Communications Act, or 

(b) the revision or replacement is by agreement between the Secretary of 
State and OFCOM. 


The guidance must be issued as one document. 


The Secretary of State must lay the guidance (including revised or replacement 
guidance) before Parliament. 


The Secretary of State must publish the guidance (and any revised or 
replacement guidance). 
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(8) OFCOM must have regard to the guidance when exercising any functions to 
which the guidance relates (or when deciding whether to exercise any such 
functions). 


Annual report 


114 Annual report on the Secretary of State’s functions 


In section 390 of the Communications Act (annual report on the Secretary of 
State’s functions), in subsection (2), after paragraph (e) insert — 
“(f) the Online Safety Act 2021.” 


Review 


115 Review 


(1) The Secretary of State must review the operation of — 
(a) the regulatory framework provided for in this Act, and 


(b) section 11 of the Communications Act, to the extent that that section 
relates to regulated services. 


(2) The review — 
(a) must not be carried out before the end of the period of two years 
beginning with the day on which Part 2 comes into force, but 


(b) must be carried out before the end of the period of five years beginning 
with that day. 


(3) The review must, in particular, consider how effective the regulatory 
framework provided for in this Act is at— 


(a) securing that regulated services are operated using systems and 
processes that — 


(i) minimise the risk of harm to individuals in the United Kingdom 
arising from (in the case of user-to-user services) content 
present on such services or (in the case of search services) 
content that may be encountered in or via search results, 


(ii) provide higher levels of protection for children than for adults, 


(iii) provide transparency and accountability to users in relation to 
actions taken to comply with duties under Chapter 2 or 3 of Part 
2 (as the case may be), 


(iv) protect the right of users and (in the case of search services) 
interested persons to freedom of expression within the law, and 


(v) protect users from unwarranted infringements of privacy; and 


(b) ensuring that regulation of services is proportionate, having regard to 
the level of risk of harm presented by regulated services of different 
kinds and to the size and capacity of providers. 


(4) The review must also, in particular, consider — 
(a) the effectiveness of — 


(i) the information gathering and information sharing powers 
available to OFCOM, and 


(ii) the enforcement powers available to OFCOM; 
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(b) whether it would be appropriate for OFCOM to be able to exercise the 
power in section 71 (requirement in information notice to name a senior 
manager), taking into account the effectiveness of OFCOM’s powers to 
obtain information under section 70; and 


(c) the extent to which OFCOM have had regard to the desirability of 
encouraging innovation by providers of regulated services. 


In carrying out the review, the Secretary of State must consult — 
(a) OFCOM, and 
(b) such other persons as the Secretary of State considers appropriate. 


The Secretary of State must prepare and publish a report on the outcome of the 
review. 


The report must be laid before Parliament. 
PART 7 


GENERAL AND FINAL PROVISIONS 
Providers of regulated services 


“Provider” of user-to-user service or search service 


This section applies to determine who is the “provider” of a user-to-user 
service or a search service for the purposes of this Act. 


The provider of a user-to-user service is to be treated as being the entity that 
has control over who can use the service (and that entity alone). 


Where no entity has control over who can use a user-to-user service, but an 
individual or individuals have control over who can use it, the provider of the 
service is to be treated as being that individual or those individuals. 


A person who provides an access facility in relation to a user-to-user service, 
within the meaning of section 93, is not to be regarded as a person who has 
control over who can use that service for the purposes of subsections (2) and 


(3). 


The provider of a search service is to be treated as being the entity that has 
control over the operations of the search engine (and that entity alone). 


Where no entity has control over the operations of the search engine, but an 
individual or individuals have control over those operations, the provider of 
the search service is to be treated as being that individual or those individuals. 


Where a user-to-user service or a search service is generated by a machine, the 
entity that controls the machine (and that entity alone) is to be treated as being 
the provider of the service. 


Where no entity controls the machine, but an individual or individuals control 
it, the provider of the service is to be treated as being that individual or those 
individuals. 


In this section “operations of the search engine” means operations which — 
(a) enable users of a search service to make search requests, and 
(b) generate responses to those requests. 
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117 Providers that are not legal persons 


1) In this section a “relevant entity” means an entity that — 
A y 
(a) is the provider of a regulated service, and 
(b) isnot a legal person under the law under which it is formed. 


(2) Ifa penalty notice is given to a relevant entity (in the name of the entity), the 
penalty is to be paid out of the funds of the entity. 


(3) If a notice under Chapter 4 (use of technology), Chapter 5 (information) or 
Chapter 6 (enforcement) of Part 4 is given to a relevant entity (in the name of 
the entity), the notice continues to have effect despite a change in the 
membership of the entity. 


(4) If a penalty notice is given jointly to two or more officers or members of a 
relevant entity, those individuals are jointly and severally liable to pay the 
penalty under it. 


(5) In subsection (4) the reference to officers or members of a relevant entity 
includes a reference to employees of such an entity or any other individuals 
associated with such an entity. 


(6) In this section a “penalty notice” means — 
(a) aconfirmation decision that imposes a penalty (see section 83(6)), 
(b) a penalty notice under section 84(3), 
(c) a penalty notice under section 89, or 
(d) a penalty notice under section 90. 


118 Individuals providing regulated services: liability 


1) This section applies in relation to two or more individuals who together are the 
PP 8 
provider of a regulated service (see section 116(3), (6) and (8)). 


(2) Any duty or requirement imposed on such a provider under Chapter 2 of Part 
2 (providers of user-to-user services: duties of care), Chapter 3 of Part 2 
(providers of search services: duties of care), Chapter 4 of Part 2 (assessment 
about access by children) or section 51 (duty to notify OFCOM), or any liability 
of such a provider to pay a fee under section 52, is to be taken to be imposed 
on, or to be a liability of, all the individuals jointly and severally. 


(3) Any notice under Chapter 4 (use of technology), Chapter 5 (information) or 
Chapter 6 (enforcement) of Part 4 in respect of a matter may be given — 
(a) to only one of the individuals, 
(b) jointly to two or more of them, or 
(c) jointly to all of them, 


but a separate notice may not be given to each of the individuals in respect of 
the matter. 


(4) Ifa penalty notice is given jointly to two or more individuals, those individuals 
are jointly and severally liable to pay the penalty under it. 


(5) In subsection (4) a “penalty notice” means — 
a) aconfirmation decision that imposes a penalty (see section 83(6)), 
p pP y 


(b) a penalty notice under section 84(3), 
(c) a penalty notice under section 89, or 
(d) a penalty notice under section 90. 
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119 Liability of parent entities for failures by subsidiary entities 


(1) Subsection (2) applies if— 
(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a 
relevant decision or notice relating to a regulated service, 
(b) Eis the provider of that service, and 
(c) there is an entity which is a parent undertaking in relation to E. 


(2) The relevant decision or notice may be given— 
(a) to E alone, or 
(b) jointly to E and to an entity which is a parent undertaking in relation to 


(3) But the decision or notice may not be given to an entity which is a parent 
undertaking unless that entity has been given an opportunity to make 
representations to OFCOM. 


(4) If a relevant decision or notice is given to entities jointly as mentioned in 
subsection (2)(b), those entities are jointly and severally liable to comply with 
the requirements, or (as the case may be) pay the penalty, imposed by the 
decision or notice. 


(5) For the purposes of this section, an entity is a “parent undertaking” in relation 
to E if that entity is a parent undertaking in relation to E within the meaning of 
section 1162 of the Companies Act 2006 by reason of meeting the condition in 
subsection (2)(b), (c) or (d) or (4) of that section. 


(6) Inits application for the purposes of this section, paragraph 4 of Schedule 7 to 
the Companies Act 2006 is to be read as if the reference to operating and 
financial policies were to policies relating to compliance with the regulatory 
requirements imposed by this Act. 


(7) For the purposes of this section, section 1162 of, and Schedule 7 to, the 
Companies Act 2006 — 


(a) are to apply in relation to an entity which is not an undertaking (as 
defined in section 1161(1) of that Act) as they apply in relation to an 
undertaking, and 


(b) are to be read with any necessary modifications if applied to an entity 
formed under the law of a country outside the United Kingdom. 


(8) In this section, “relevant decision or notice” means — 
(a) aconfirmation decision, 
(b) a penalty notice under section 84(3), 
(c) a penalty notice under section 89, or 
(d) a penalty notice under section 90. 


120 Liability of controlling individuals for failures by entities 


(1) Subsection (2) applies if — 
(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a 
relevant decision or notice relating to a regulated service, 
(b) Eis the provider of that service, and 
(c) an individual or individuals control E. 


(2) The relevant decision or notice may be given— 
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(a) to E alone, or 
(b) jointly to E and to the individual or individuals who control E. 


But the decision or notice may not be given to an individual or individuals 
unless that individual or those individuals have been given an opportunity to 
make representations to OFCOM. 


If a relevant decision or notice is given jointly to E and to an individual or 
individuals as mentioned in subsection (2)(b), that entity and that individual or 
those individuals are jointly and severally liable to comply with the 
requirements, or (as the case may be) pay the penalty, imposed by the decision 
or notice. 


For the purposes of this section, an individual or individuals are to be taken to 
“control” E if that individual or those individuals would, if they were an 
undertaking, be a parent undertaking in relation to E within the meaning of 
section 1162 of the Companies Act 2006 by reason of meeting the condition in 
subsection (2)(b), (c) or (d) or (4)(a) of that section. 


In its application for the purposes of this section, paragraph 4 of Schedule 7 to 
the Companies Act 2006 is to be read as if the reference to operating and 
financial policies were to policies relating to compliance with the regulatory 
requirements imposed by this Act. 


For the purposes of this section, section 1162 of, and Schedule 7 to, the 
Companies Act 2006 — 
(a) are to apply in relation to an entity which is not an undertaking (as 
defined in section 1161(1) of that Act) as they apply in relation to an 
undertaking, and 


(b) are to be read with any necessary modifications if applied to an entity 
formed under the law of a country outside the United Kingdom. 


In this section, “relevant decision or notice” means — 
(a) aconfirmation decision, 
(b) a penalty notice under section 84(3), 
(c) a penalty notice under section 89, or 
(d) a penalty notice under section 90. 


121 Liability of subsidiary entities for failures by parent or fellow subsidiary 


(1) 


(2) 


(3) 


entities 


Subsection (2) applies if — 
(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a 
relevant decision or notice relating to a regulated service, 
(b) Eis the provider of that service, and 
(c) Eis a parent undertaking in relation to another undertaking. 


The relevant decision or notice may be given— 
(a) to E alone, or 
(b) jointly to E and to an entity which is a subsidiary undertaking of E. 


But the decision or notice may be given to an entity which is a subsidiary 
undertaking only if — 
(a) that entity’s acts or omissions contributed to the failure in respect of 
which the decision or notice is given, and 
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(b) that entity has been given an opportunity to make representations to 
OFCOM. 


(4) Subsection (5) applies if — 
(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a 
relevant decision or notice relating to a regulated service, 
(b) Eis the provider of that service, 
(c) Eis a subsidiary undertaking, and 
(d) there are, in relation to E, one or more entities which are fellow 
subsidiary undertakings. 


(5) The relevant decision or notice may be given — 
(a) to E alone, or 
(b) jointly to E and to an entity which is a fellow subsidiary undertaking. 


(6) But the decision or notice may be given to an entity which is a fellow subsidiary 
undertaking only if — 


(a) that entity’s acts or omissions contributed to the failure in respect of 
which the decision or notice is given, and 


(b) that entity has been given an opportunity to make representations to 
OFCOM. 


(7) If a relevant decision or notice is given to entities jointly as mentioned in 
subsection (2)(b) or (5)(b), those entities are jointly and severally liable to 
comply with the requirements, or (as the case may be) pay the penalty, 
imposed by the decision or notice. 


(8) In this section— 


“fellow subsidiary undertaking” has the meaning given by section 1161(4) 
of the Companies Act 2006; 


“parent undertaking” is to be read in accordance with section 1162 of the 
Companies Act 2006; 
“relevant decision or notice” means — 
(a) aconfirmation decision, 
(b) a penalty notice under section 84(3), 
(c) a penalty notice under section 89, or 
(d) a penalty notice under section 90; 


“subsidiary undertaking” is to be read in accordance with section 1162 of 
the Companies Act 2006. 


(9) For the purposes of this section, sections 1161(4) and 1162 of, and Schedule 7 
to, the Companies Act 2006 — 
(a) are to apply in relation to an entity which is not an undertaking (as 
defined in section 1161(1) of that Act) as they apply in relation to an 
undertaking, and 


(b) are to be read with any necessary modifications if applied to an entity 
formed under the law of a country outside the United Kingdom. 


Users of regulated services 


122 “User” and “United Kingdom user” of service 


(1) For the purposes of this Act a user is a “United Kingdom user” of a service if — 
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(a) where the user is an individual, the individual is in the United 
Kingdom; 

(b) where the user is an entity, the entity is incorporated or formed under 
the law of any part of the United Kingdom. 


(2) For the purposes of references in this Act to a user of a service it does not matter 
whether a person is registered to use a service. 


(3) References in this Act to a user of a service do not include references to any of 
the following when acting in the course of the provider’s business — 

(a) where the provider of the service is an individual or individuals, that 
individual or those individuals; 

(b) where the provider is an entity, officers of the entity; 

(c) persons who work for the provider (including as employees or 
volunteers); 

(d) any other person providing a business service to the provider such as a 
contractor, consultant or auditor. 


(4) Insubsection (3) “acting in the course of the provider’s business” means (as the 
case may be) — 
(a) acting in the course of the provider’s business of providing the service, 
or 
(b) acting in the course of a business, trade, profession or other concern — 
(i) carried on (whether or not for profit) by the provider of the 
service, and 


(ii) for the purposes of which the service is provided. 


(5) In subsection (3) “officer” includes a director, manager, partner, associate, 
secretary or other similar officer. 


(6) In this section “service” (except in the term “business service”) means internet 
service, user-to-user service or search service. 


Supplementary provision about offences 


123 Information offences: supplementary 


(1) Proceedings for an offence under section 72(2) may be brought in respect of a 
failure by a person to comply with the requirements of an information notice 
only if — 

(a) OFCOM have given the person a provisional notice of enforcement 
action in respect of that failure, 

(b) OFCOM have given the person a confirmation decision in respect of 
that failure and the time allowed under that decision has expired 
without the requirements of the information notice having been 
complied with, 

(c) OFCOM have not imposed a penalty on the person in respect of that 
failure, 

(d) a service restriction order under section 91 has not been made in 
relation to a regulated service provided by the person in respect of that 
failure, and 

(e) an access restriction order under section 93 has not been made in 
relation to a regulated service provided by the person in respect of that 
failure. 
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Proceedings for an offence under section 73(2) (failure by named senior 
manager to prevent offence under section 72(2)) may be brought only if the 
conditions in subsection (1) are met in respect of the offence under section 
72(2). 

A person on whom a penalty is imposed may not at any time be convicted of 


an offence under section 72 in respect of the act or omission giving rise to the 
penalty. 


An individual may not at any time be convicted of an offence under section 73 
in respect of a failure to prevent an offence by an entity under section 72, if a 
penalty is imposed on the entity in respect of the act or omission constituting 
the offence under section 72. 


In this section “penalty” means a penalty imposed by — 
(a) aconfirmation decision (see section 83(6)), or 
(b) a penalty notice under section 84(3). 


124 Defences 


(1) 
(2) 


Subsection (2) applies where a person relies on a defence under section 72 or 73. 


If evidence is adduced which is sufficient to raise an issue with respect to the 
defence, the court must assume that the defence is satisfied unless the 
prosecution proves beyond reasonable doubt that it is not. 


125 Liability of corporate officers for information offences 


(1) 


(2) 


In this section a “relevant entity” means an entity that is— 
(a) the provider of a regulated service, and 
(b) a legal person under the law under which it is formed. 


If an offence under section 72 committed by a relevant entity is proved to have 
been committed with the consent or connivance of, or to be attributable to any 
neglect on the part of, an officer, the officer (as well as the entity) is guilty of the 
offence and (subject to section 123(1)) is liable to be proceeded against and 
punished accordingly. 


In relation to an entity which is a body corporate, “officer” means — 

(a) a person occupying the position of a director, manager, secretary or 

other similar officer of the entity (by whatever name called), or 

(b) a person purporting to act in any such capacity. 
In relation to a partnership which is not regarded as a body corporate under 
the law under which it is formed, “officer” means — 

(a) apartner, or 

(b) a person purporting to act as a partner. 


If the affairs of an entity which is a body corporate are managed by its 
members, subsection (2) applies in relation to the acts and omissions of a 
member in connection with the functions of management as if the member 
were an officer of the entity. 


In this section “body corporate” includes an entity incorporated outside the 
United Kingdom. 
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126 Application of information offences to providers that are not legal persons 


(1) 


(2) 


In this section a “relevant entity” means an entity that — 
(a) is the provider of a regulated service, and 
(b) is not a legal person under the law under which it is formed. 


Proceedings for an offence under section 72 alleged to have been committed by 
a relevant entity must be brought against the entity in its own name (and not 
in that of any of its officers, members or partners). 


For the purposes of such proceedings — 
(a) rules of court relating to the service of documents have effect as if the 
entity were a body corporate; and 
(b) the following provisions apply as they apply in relation to a body 
corporate — 
(i) section 33 of the Criminal Justice Act 1925 and Schedule 3 to the 
Magistrates’ Courts Act 1980; 
(ii) section 18 of the Criminal Justice Act (Northern Ireland) 1945 
(c.15 (N.I.)) and Article 166 of, and Schedule 4 to, the 
Magistrates’ Courts (Northern Ireland) Order 1981 (S.I. 1981/ 
1675 (N.I. 26)). 


A fine imposed on a relevant entity on its conviction of an offence under 
section 72 is to be paid out of the entity’s funds. 


If an offence under section 72 committed by a relevant entity is proved to have 
been committed with the consent or connivance of, or to be attributable to any 
neglect on the part of, an officer, the officer (as well as the entity) is guilty of the 
offence and (subject to section 123(1)) is liable to be proceeded against and 
punished accordingly. 


In relation to a partnership, “officer” means — 
(a) apartner, or 
(b) a person purporting to act as a partner. 


In relation to a relevant entity other than a partnership, “officer” means — 
(a) an officer of the entity or a person concerned in the management or 
control of the entity, or 


(b) a person purporting to act in such a capacity. 


Subsection (2) is not to be read as prejudicing any liability of an officer under 
subsection (5). 


Extra-territorial application 


127 Extra-territorial application 


(1) 


(2) 


References in this Act to an internet service, a user-to-user service or a search 
service include such a service provided from outside the United Kingdom (as 
well as such a service provided from within the United Kingdom). 


The power by notice under section 70 to require the production of documents 
includes a power for such a notice to require the production of documents held 
outside the United Kingdom. 
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(3) The power conferred by section 76 includes a power to require the attendance 
for interview of an individual who is outside the United Kingdom. 


128 Information offences: extra-territorial application and jurisdiction 


1) Section 72 applies to acts done in the United Kingdom or elsewhere by a 
PP 8 y 
provider of a regulated service (information offences). 


(2) Section 73 applies to acts done in the United Kingdom or elsewhere by an 
individual (offences by senior managers of providers of regulated services). 


(3) Sections 125(2) and 126(5) apply to acts done in the United Kingdom or 
elsewhere by an individual (liability of directors etc of providers of regulated 
services). 


(4) Inthe case of an offence under section 72 or 73 which is committed outside the 
United Kingdom — 
(a) proceedings for the offence may be taken at any place in the United 
Kingdom, and 
(b) the offence may for all incidental purposes be treated as having been 
committed at any such place. 


(5) Inthe application of subsection (4) to Scotland, any such proceedings against a 
person may be taken — 
(a) in any sheriff court district in which the person is apprehended or is in 
custody, or 
(b) in such sheriff court district as the Lord Advocate may determine. 


(6) In this section— 
“act” includes a failure to act; 


“sheriff court district” is to be construed in accordance with the Criminal 
Procedure (Scotland) Act 1995 (see section 307(1) of that Act). 


Service of notices 


129 Service of notices 


(1) This section applies in relation to a notice given by OFCOM to a person 
under — 


(a) section 49(1) (notice relating to transparency report), 
(b) Chapter 4 of Part 4 (use of technology), 

(c) Chapter 5 of Part 4 (information), 

(d) Chapter 6 of Part 4 (enforcement powers), or 

(e) section 112(4) or (5) (public statement notice etc). 


(2) OFCOM may give a notice to a person by — 
(a) handing it to the person, 
(b) leaving it at the person’s proper address, 
(c) sending it by post to the person at that address, or 
(d) sending it by email to the person’s email address. 


(3) A notice to a body corporate may be given to any officer of that body. 
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(4) 
(5) 


A notice to a partnership may be given to a partner or a person who has the 
control or management of the partnership business. 


A notice to an entity that is not a legal person under the law under which it is 
formed (other than a partnership) may be given to any member of the 
governing body of the entity. 


In the case of a notice given to a person who is a provider of a regulated service, 
the person’s proper address for the purposes of paragraphs (b) and (c) of 
subsection (2), and section 7 of the Interpretation Act 1978 in its application to 
those paragraphs, is any address (within or outside the United Kingdom) at 
which OFCOM believe, on reasonable grounds, that the notice will come to the 
attention of the person or (where the person is an entity) any director or other 
officer of that entity. 


In the case of a notice given to a person other than a provider of a regulated 
service, a person’s proper address for the purposes of paragraphs (b) and (c) of 
subsection (2), and section 7 of the Interpretation Act 1978 in its application to 
those paragraphs, is — 
(a) inthe case of an entity, the address of the entity’s registered or principal 
office; 
(b) in any other case, the person’s last known address. 


In the case of an entity registered or carrying on business outside the United 
Kingdom, or with offices outside the United Kingdom, the reference in 
subsection (7) to its principal office includes its principal office in the United 
Kingdom or, if the entity has no office in the United Kingdom, any place in the 
United Kingdom at which OFCOM believe, on reasonable grounds, that the 
notice will come to the attention of any director or other officer of that entity. 


For the purposes of subsection (2)(d), a person’s email address is — 
(a) any email address published for the time being by that person as an 
address for contacting that person, or 
(b) if there is no such published address, any email address by means of 
which OFCOM believe, on reasonable grounds, that the notice will 
come to the attention of that person or (where that person is an entity) 
any director or other officer of that entity. 


A notice sent to a person by email is to be taken to have been given to that 
person 48 hours after it is sent. 


In this section— 
“director” includes any person occupying the position of a director, by 
whatever name called; 
“officer”, in relation to an entity, includes a director, a manager, a 
secretary or, where the affairs of the entity are managed by its 
members, a member. 


Repeals 


130 Repeal of Part 4B of the Communications Act 


(1) 
(2) 


In the Communications Act, omit Part 4B (video-sharing platform services). 


In the Audiovisual Media Services Regulations 2020 (S.I. 2020/1062), omit Part 
4 (which inserts Part 4B into the Communications Act). 
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131 Repeals: Digital Economy Act 2017 
(1) The Digital Economy Act 2017 is amended as follows. 
(2) Omit Part 3 (online pornography). 


(3) Omit section 103 (code of practice for providers of online social media 
platforms). 


Regulations 


132 Regulations 


(1) Regulations under this Act may make different provision for different 
purposes and may, in particular — 
(a) make different provision with regard to— 
(i) user-to-user services, and 
(ii) search services; 


(b) make different provision with regard to user-to-user services of 
different kinds; 


(c) make different provision with regard to search services of different 
kinds. 


(2) Regulations under this Act may make supplemental, incidental, consequential, 
transitional or saving provision. 


(3) Any power of the Secretary of State under this Act to make regulations is 
exercisable by statutory instrument. 


(4) A statutory instrument containing (whether alone or with other provision) — 
(a) regulations under section 3(8), (9) or (11), 

regulations under section 30(5), 

regulations under section 39(12) or (13), 

regulations under section 42(2 


) 

) ( 

) (2), 
(e) regulations under section 43(2) 

) ( 

) 

) 


regulations under section 51(8), 
regulations under section 85(14), or 
regulations under section 106(3), 


may not be made unless a draft of the instrument has been laid before, and 
approved by a resolution of, each House of Parliament. 


(5) A statutory instrument containing — 
(a) regulations under section 41, 
) regulations under section 45, 
(c) regulations under section 46, 
(d) regulations under section 49(6) or (7), 
(e) regulations under section 107, or 
(f) regulations under paragraph 1 of Schedule 4, 
is subject to annulment in pursuance of a resolution of either House of 
Parliament. 


(6) But on the occasion of the first exercise of the power to make regulations 
under — 
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(a) section 41, 
(b) section 45, or 
(c) section 46, 


the instrument containing the regulations may not be made unless a draft of 
the instrument has been laid before, and approved by a resolution of, each 
House of Parliament. 


(7) Regulations made by the Scottish Ministers under section 43(3) are subject to 
the affirmative procedure (see section 29 of the Interpretation and Legislative 
Reform (Scotland) Act 2010 (asp 10)). 


(8) This section does not apply to regulations under section 140 (commencement). 
Interpretation 


133 Meaning of “internet service” 


(1) In this Act “internet service” means a service that is made available by means 
of the internet. 


(2) For the purposes of subsection (1) a service is “made available by means of the 
internet” even where it is made available by means of a combination of — 


(a) the internet, and 
(b) an electronic communications service. 


(3) “Electronic communications service” has the same meaning as in the 
Communications Act (see section 32(2) of that Act). 


134 Meaning of terms relating to search services 
(1) This section applies for the purposes of this Act. 


(2) “Search engine” — 

(a) includes a service or functionality which enables a person to search 
some websites or databases (as well as a service or functionality which 
enables a person to search (in principle) all websites or databases); 

(b) does not include a service which enables a person to search just one 
website or database. 


(3) “Search” means search by any means, including by input of text or images or 
by speech, and references to a search request are to be construed accordingly. 


(4) “Search results”, in relation to a search service, means content presented to a 
user of the service by operation of the search engine in response to a search 
request made by the user. 


(5) But “search results” does not include paid-for advertisements (as defined in 
section 39(7)). 


(6) References in this Act to encountering content “via search results” — 
(a) are to encountering content as a result of interacting with search results 
(for example, by clicking on them); 
(b) do not include references to encountering content as a result of 
subsequent interactions with an internet service other than the search 
service. 
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(7) “Interested person”, in relation to a search service, means a person that is 
responsible for a website or database capable of being searched by the search 
engine, provided that — 

(a) in the case of an individual, the individual is in the United Kingdom; 


(b) in the case of an entity, the entity is incorporated or formed under the 
law of any part of the United Kingdom. 


(8) In subsections (4), (6) and (7), references to a search service include references 
to a user-to-user service that includes a search engine. 


135 Meaning of “functionality” 


(1) In this Act “functionality”, in relation to a user-to-user service, includes any 
feature that enables interactions of any description between users of the service 
by means of the service, and includes any feature enabling a user to do 
anything listed in subsection (2). 


(2) The things are— 

(a) creating a user profile, including an anonymous or pseudonymous 
profile; 

(b) searching within the service for user-generated content or other users 
of the service; 

(c) forwarding content to, or sharing content with, other users of the 
service; 

(d) sharing content on other internet services; 


(e) sending direct messages to or speaking to other users of the service, or 
interacting with them in another way (for example by playing a game); 
(f) expressing a view on content, including, for example, by — 
(i) applying a “like” or “dislike” button or other button of that 
nature, 
(ii) applying an emoji or symbol of any kind, 
(iii) engaging in yes/no voting, or 
(iv) rating or scoring content in any way (including giving star or 
numerical ratings); 


(g) sharing current or historic location information with other users of the 
service, recording a user’s movements, or identifying which other users 
of the service are nearby; 

(h) following or subscribing to particular kinds of content or particular 
users of the service; 

(i) creating lists, collections, archives or directories of content or users of 
the service; 
(j) tagging or labelling content present on the service; 

(k) uploading content relating to goods or services; 

(l) applying or changing settings on the service which affect the 
presentation of user-generated content on the service; 


(m) accessing other internet services through content present on the service 
(for example through hyperlinks). 


3) In this Act “functionality”, in relation to a search service, includes (in 
y 
particular) a feature that enables users to search websites or databases. 


4) In this section “user-generated content” has the meaning given by section 39 
8 88 y 
(see subsections (3) and (4) of that section). 
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136 Meaning of “online safety functions” and “online safety matters” 


(1) Inthis Act references to OFCOM’s “online safety functions” — 


(a) are references to the functions that OFCOM have under the following 
enactments — 
(i) this Act, 

(ii) section 3 of the Communications Act (general duties), so far as 
duties under that section relate to a function which is an online 
safety function by reason of any other provision of this 
subsection, 


(iii) section 7 of the Communications Act (duty to carry out impact 
assessments), so far as functions under that section relate to 
regulated services, 


(iv) section 11 of the Communications Act (duty to promote media 
literacy), so far as functions under that section relate to 
regulated services, 


(v) section 14(6)(a) of the Communications Act (research about 
media literacy), so far as the function under that provision 
relates to regulated services, 


(vi) section 14(6B) of the Communications Act (research about 
users’ experience of regulated services); 


(b) include references to OFCOM’s power to do anything appearing to 
them to be incidental or conducive to the carrying out of any of their 
functions mentioned in paragraph (a)(i), (iii), (iv), (v) or (vi) (See section 
1(3) of the Communications Act). 


(2) In this Act “online safety matters” means the matters to which OFCOM’s 
online safety functions relate. 


137 Interpretation 


(1) In this Act— 
“adult” means a person aged 18 or over; 
“child” means a person under the age of 18; 
“the Communications Act” means the Communications Act 2003; 
“confirmation decision” means a confirmation decision under section 83; 


“content” means anything communicated by means of an internet service, 
whether publicly or privately, including written material or messages, 
oral communications, photographs, videos, visual images, music and 
data of any description; 


“the Convention” has the meaning given by section 21(1) of the Human 
Rights Act 1998; 


“country” includes territory; 


“encounter”, in relation to content, means read, view, hear or otherwise 
experience content; 


“entity” means a body or association of persons or an organisation, 
regardless of whether the body, association or organisation is — 


(a) formed under the law of any part of the United Kingdom or of 
a country outside the United Kingdom, or 


(b) a legal person under the law under which it is formed; 
“functions” includes powers and duties; 
“harm” means physical or psychological harm; 
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(2) 


(3) 


138 


“information notice” means an information notice under section 70; 


“likely to be accessed by children” is to be construed in accordance with 
section 26 (see subsections (5) and (8) of that section); 

“notice” means notice in writing; 

“notify” means notify in writing, and “notification” is to be construed 
accordingly; 

“person” includes (in addition to an individual and a body of persons 
corporate or unincorporate) any organisation or association of persons; 

“provisional notice of enforcement action” means a provisional notice of 
enforcement action under section 80; 

“publicly available” means available to members of the public in the 
United Kingdom; 

“terms of service”, in relation to a user-to-user service, means the terms 
and conditions for use of the service by United Kingdom users. 


References in this Act to “taking down” content are to any action that results in 
content being removed from a user-to-user service or being permanently 
hidden so users of the service cannot encounter it (and related expressions are 


to be 


construed accordingly). 


For the purposes of this Act— 


(a) 


(b) 


The 


any reference to the use of or access to a service, or to content present 
on a service, is to be taken to include use of or access to the service or 
content on registering or on the making of a payment or on 
subscription; 

any reference to content that is made available or that may be accessed, 
encountered or shared, is to be taken to include content that is made 
available or that may be accessed, encountered or shared for a limited 
period of time only. 


Index of defined expressions 


Table below lists provisions which define or otherwise explain terms 


defined for this Act or for a Part of this Act. 


adult section 137 
Category 1 service section 59(6)(a) 
Category 2A service section 59(6)(b) 
Category 2B service section 59(6)(c) 
Chapter 2 safety duty (in Part 2) section 48 
Chapter 3 safety duty (in Part 2) section 48 
child section 137 

the Communications Act section 137 
confirmation decision section 137 


content section 137 
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content that is harmful to adults (in Part 2) 
content that is harmful to children (in Part 2) 
the Convention 

country 

CSEA content (in Part 2) 

CSEA offence (in Part 2) 

encounter 

entity 

functionality 

functions 

harm 

illegal content (in Part 2) 

information notice 

interested person 


internet service 


section 46 
section 45 
section 137 
section 137 
section 41 
section 43 
section 137 
section 137 
section 135 
section 137 
section 137 
section 41 
section 137 


section 134 


section 133 (see also 


10 


15 


section 127(1)) 
sections 26 and 137 
section 39(8) to (10) 


likely to be accessed by children 


news publisher content (in Part 2) 


non-designated content that is harmful to 
children (in Part 2) 


notice 

notify 

online safety functions 
online safety matters 
person 


primary priority content that is harmful to 
children (in Part 2) 


priority content that is harmful to adults (in 
Part 2) 


priority content that is harmful to children 
(in Part 2) 


priority illegal content (in Part 2) 


provider 


section 45 


section 137 
section 137 
section 136 
section 136 
section 137 


section 45 


section 46 


section 45 


section 41 


section 116 
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provisional notice of enforcement action section 137 
publicly available section 137 
recognised news publisher (in Part 2) section 40 
regulated content (in Part 2) section 39 
regulated search service section 3(4) 
regulated service section 3(2) 
regulated user-to-user service section 3(3) 
search section 134 
search engine section 134 
search request section 134 
search results section 134 
search service section 2 (see also 
section 127(1)) 
taking down (content) section 137(2) 
terms of service section 137 
terrorism content (in Part 2) section 41 
terrorism offence (in Part 2) section 42 
United Kingdom user section 122 
user section 122 
user-generated content (in Part 2) section 39(3) and (4) 
user-to-user service section 2 (see also 
section 127(1)) 
via search results section 134 
Final provisions 
139 Extent 


This Act extends to England and Wales, Scotland and Northern Ireland. 


140 Commencement 


(1) 


The following provisions come into force on the day on which this Act is 


passed — 
(a) sections 1 and 2, 
(b) section 3(1) to (7) and Schedule 1, 
(c) section 4, 
(d) section 39(1) to (11) and (14), 
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(6) 


141 


(e) sections 40 and 41, 
(f) section 42(1) and Schedule 2, 
(g) section 43(1) and Schedule 3, 
(h) sections 44 to 46, 
(i) section 47(1) and (2), 
(j) section 48, 
(k) section 106(3) to (6), 
(l) section 107, 
(m) section 116, 
(n) section 122, 
(0) section 127(1), 
( sections 132 to 135, 
( sections 137 to 139, 


— 
we QO 
—_— N N N N 


this section, and 
section 141. 


The remaining provisions of this Act come into force on such day as the 
Secretary of State may by regulations appoint. 


Different days may be appointed for different purposes. 


The day appointed for the coming into force of — 
(a) section 71 (requirement to name a senior manager), and 
(b) section 73 (senior managers’ liability: information offences), 


may not be a day that precedes the publication of the report on the outcome of 
the review required by section 115 (Secretary of State’s review). 


The Secretary of State may by regulations make transitional or saving 
provision in connection with the coming into force of any provision of this Act. 


Any power under this section to make regulations is exercisable by statutory 
instrument. 


Short title 


This Act may be cited as the Online Safety Act 2021. 
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SCHEDULES 
SCHEDULE 1 Section 3 
EXEMPT SERVICES 
Email services 
1 A user-to-user service is exempt if emails are the only user-generated 


content enabled by the service. 
SMS and MMS services 


2 (1) A user-to-user service is exempt if SMS messages are the only user- 
generated content enabled by the service. 


(2) A user-to-user service is exempt if MMS messages are the only user- 
generated content enabled by the service. 


(3) A user-to-user service is exempt if SMS messages and MMS messages are the 
only user-generated content enabled by the service. 


(4) “SMS message” and “MMS message” have the meaning given by section 
39(14). 


Services offering only one-to-one live aural communications 


3 (1) A.user-to-user service is exempt if one-to-one live aural communications are 
the only user-generated content enabled by the service. 


(2) “One-to-one live aural communications” has the meaning given by section 
39(6). 


Internal business services 


4 (1) A user-to-user service or a search service is exempt if the conditions in sub- 
paragraph (2) are satisfied in relation to the service. 


(2) The conditions are — 
(a) the service is an internal resource or tool for a business, or for more 
than one business carried on by the same person, 
(b) the person carrying on the business (or businesses) (“P”) is the 
provider of the service, and 
(c) the service is available only to a closed group of people comprising 
some or all of the following — 
(i) where P is an individual or individuals, that individual or 
those individuals, 
(ii) where P is an entity, officers of P, 
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(iii) persons who work for P (including as employees or 
volunteers) for the purposes of any activities of the business 
(or any of the businesses) in question, and 


(iv) any other persons authorised by a person within sub- 
paragraph (i), (ii) or (iii) to use the service for the purposes of 
any activities of the business (or any of the businesses) in 
question (for example, a contractor, consultant or auditor). 


(3) A search service is also exempt if the conditions in sub-paragraph (2) are 
satisfied in relation to the part of the service that is a search engine (reading 
references in that sub-paragraph to the service as references to the search 
engine). 

(4) In this paragraph — 

“business” includes trade, profession or other concern (whether or not 
carried on for profit); 


“officer” includes a director, manager, partner, associate, secretary or 
other similar officer. 


Limited functionality services 


5 A user-to-user service is exempt if the functionalities of the service are 
limited, such that users are able to communicate by means of the service 
only in the following ways— 


(a) posting comments or reviews relating to content produced and 
published by the provider of the service (or by a person acting on 
behalf of the provider of the service); 


(b) sharing such comments or reviews on a different internet service; 


(c) expressing a view on such comments or reviews, or on content 
mentioned in sub-paragraph (a), by means of — 


(i) applying a “like” or “dislike” button or other button of that 
nature, 


(ii) applying an emoji or symbol of any kind, 

(iii) engaging in yes/no voting, or 

(iv) rating or scoring the content (or the comments or reviews) in 
any way (including giving star or numerical ratings). 


Public bodies 


6 (1) A user-to-user service or a search service is exempt if — 
(a) both of the following conditions apply in relation to the service — 
(i) the provider of the service is a public authority within the 
meaning of section 6 of the Human Rights Act 1998, and 
(ii) the service is provided in the exercise of public functions 
only, 
(b) the provider of the service is Parliament, or either House of 
Parliament, 
(c) the provider of the service is a foreign sovereign power, or 
(d) both of the following conditions apply in relation to the service — 


(i) the provider of the service is an entity formed under the law 
of a country outside the United Kingdom, which exercises 
functions of a public nature, and 


(ii) the service is provided in the exercise of such functions only. 
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(2) In this paragraph, “public function” means a function that is a function of a 
public nature for the purposes of the Human Rights Act 1998. 


Interpretation 


7 In this Schedule “user-generated content” has the meaning given by section 
39 (see subsections (3) and (4) of that section). 


SCHEDULE 2 Section 42 
TERRORISM OFFENCES 


1 An offence under any of the following provisions of the Terrorism Act 
2000 — 


(a) section 11 (membership of a proscribed organisation); 

(b) section 12(1) (inviting support for a proscribed organisation); 

(c) section 12(1A) (expressing an opinion or belief supportive of a 
proscribed organisation); 


(d) section 12(2) (arranging a meeting supportive of a proscribed 


organisation); 

(e) section 13(1A) (publishing image of uniform of proscribed 
organisation); 

(f) section 15(1) (terrorist fund-raising); 

( section 54(1) (providing weapons training); 


) 
8) 
h) section 54(3) (inviting another to receive weapons training); 
(i) section 56 (directing a terrorist organisation); 
(j) section 58 (collection of information likely to be of use to a terrorist); 
k) 


section 58A (publishing information about members of the armed 
forces etc); 


(1) sections 59 to 61 (inciting terrorism outside the United Kingdom). 


2 An offence under section 113 of the Anti-terrorism, Crime and Security Act 
2001 (use of noxious substances or things). 

3 An offence under any of the following provisions of the Terrorism Act 
2006 — 


(a) section 1 (encouragement of terrorism); 
) section 2 (dissemination of terrorist publications); 
(c) section 5 (preparation of terrorist acts); 
(d) section 6 (training for terrorism); 
(e) section 11 (terrorist threats relating to radioactive devices etc). 


Inchoate offences 


4 (1) Anoffence of attempting or conspiring to commit an offence specified in this 
Schedule. 


(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or 
assisting) in relation to an offence specified in this Schedule (or, in Scotland, 
inciting a person to commit such an offence). 
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(3) An offence of aiding, abetting, counselling or procuring the commission of 
an offence specified in this Schedule (or, in Scotland, being involved art and 
part in the commission of such an offence). 


SCHEDULE 3 Section 43 
CHILD SEXUAL EXPLOITATION AND ABUSE OFFENCES 
PART 1 
ENGLAND AND WALES 


1 An offence under section 1 of the Protection of Children Act 1978 (indecent 
photographs of children). 


2 An offence under section 160 of the Criminal Justice Act 1988 (possession of 
indecent photograph of a child). 


3 An offence under any of the following provisions of the Sexual Offences Act 
2003 — 
(a) section 8 (causing or inciting a child under 13 to engage in sexual 
activity); 
(b) section 10 (causing or inciting a child to engage in sexual activity); 
(c) section 12 (causing a child to watch a sexual act); 
(d) section 13 (child sex offences committed by children or young 
persons); 
(e) section 14 (arranging or facilitating commission of a child sex 
offence); 
) section 15 (meeting a child following sexual grooming etc); 
g) section 15A (sexual communication with a child); 
(h) section 47 (paying for sexual services of a child); 
) section 48 (causing or inciting sexual exploitation of a child); 
) section 49 (controlling a child in relation to sexual exploitation); 
(k) section 50 (arranging or facilitating sexual exploitation of a child). 


4 An offence under section 62 of the Coroners and Justice Act 2009 (possession 
of prohibited image of a child). 


5 An offence under section 69 of the Serious Crime Act 2015 (possession of 
paedophile manual). 


Inchoate offences 


6 (1) Anoffence of attempting or conspiring to commit an offence specified in this 
Part. 


(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or 
assisting) in relation to an offence specified in this Part. 


(3) An offence of aiding, abetting, counselling or procuring the commission of 
an offence specified in this Part. 
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PART 2 


SCOTLAND 


7 An offence under either of the following provisions of the Civic Government 
(Scotland) Act 1982 — 


(a) 
(b) 


section 52 (indecent photographs etc of children); 
section 52A (possession of indecent photographs of children). 


8 An offence under any of the following provisions of the Protection of 
Children and Prevention of Sexual Offences (Scotland) Act 2005 — 


(a) 


section 1 (meeting a child following certain preliminary contact); 
section 10 (causing or inciting provision by child of sexual services or 
child pornography); 


(c) section 11 (controlling a child providing sexual services or involved 
in pornography). 
9 An offence under any of the following provisions of the Sexual Offences 
(Scotland) Act 2009 — 
(a) section 23 (causing a young child to look at a sexual image); 
(b) section 24 (communicating indecently with a young child etc); 
(c) section 33 (causing an older child to look at a sexual image); 
(d) section 34 (communicating indecently with an older child etc); 
(e) section 54 (incitement to commit certain sexual acts outside 


Inchoate offences 


Scotland). 


10 (1) Anoffence of attempting or conspiring to commit an offence specified in this 


Part. 


(2) An offence of inciting a person to commit an offence specified in this Part. 


(3) An offence of aiding, abetting, counselling or procuring the commission of 
an offence specified in this Part, or being involved art and part in the 
commission of such an offence. 


PART 3 


NORTHERN IRELAND 


11 An offence under Article 3 of the Protection of Children (Northern Ireland) 
Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children). 


12 An offence under any of the following provisions of the Sexual Offences 
(Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))— 


(a) 


Article 15 (causing or inciting a child under 13 to engage in sexual 
activity); 

Article 17 (causing or inciting a child to engage in sexual activity); 
Article 19 (causing a child to watch a sexual act); 

Article 20 (sexual offences against children committed by children or 
young persons); 

Article 21 (arranging or facilitating commission of a sex offence 
against a child); 
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(f) Article 22 (meeting a child following sexual grooming etc); 
(g) Article 22A (sexual communication with a child); 
(h) Article 38 (causing or inciting child prostitution or pornography); 
(i) Article 39 (controlling a child prostitute or a child involved in 
pornography); 
(j) Article 40 (arranging or facilitating child prostitution or 
pornography). 


Inchoate offences 


13 (1) Anoffence of attempting or conspiring to commit an offence specified in this 
Part. 


(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or 
assisting) in relation to an offence specified in this Part. 


(3) An offence of aiding, abetting, counselling or procuring the commission of 
an offence specified in this Part. 


SCHEDULE 4 Section 59 
CATEGORIES OF REGULATED SERVICES: REGULATIONS 
Regulations specifying threshold conditions for categories of regulated services 


1 (1) The Secretary of State must make regulations specifying precise conditions 
(“Category 1 threshold conditions”) for regulated user-to-user services 
relating to each of the following — 

(a) number of users, and 
(b) functionalities. 


(2) The Secretary of State must make regulations specifying precise conditions 
(“Category 2A threshold conditions”) for regulated search services relating 
to each of the following — 

(a) number of users, and 
(b) any other factors that the Secretary of State considers relevant. 


(3) The Secretary of State must make regulations specifying precise conditions 
(“Category 2B threshold conditions”) for regulated user-to-user services 
relating to each of the following — 

(a) number of users, 
(b) functionalities, and 
(c) any other factors that the Secretary of State considers relevant. 


(4) Regulations under this paragraph must specify the way or ways in which a 
service may count as meeting the relevant threshold conditions, and that 
may be by meeting the conditions in any specified combination, subject to 
the rule that — 

(a) in the case of a user-to-user service, at least one specified condition 
about number of users and at least one specified condition about 
functionality must be met, and 

(b) in the case of a search service, at least one specified condition about 
number of users must be met. 
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(5) 


(8) 


In making regulations under sub-paragraph (1), the Secretary of State must 
take into account the likely impact of the number of users of a service, and 
its functionalities, on the level of risk of harm to adults from content that is 
harmful to adults disseminated by means of the service. 


In making regulations under sub-paragraph (2), the Secretary of State must 
take into account the likely impact of the number of users of a service on the 
level of risk of harm to individuals from illegal content and content that is 
harmful to children that may be encountered in or via search results. 


In making regulations under sub-paragraph (3), the Secretary of State must 
take into account the likely impact of the number of users of a service, and 
its functionalities, on the level of risk of harm to individuals from illegal 
content, content that is harmful to children and content that is harmful to 
adults disseminated by means of the service. 


In this paragraph “specified” means specified in the regulations. 


Procedure for first regulations under paragraph 1 


2 (I) 


(2) 


This paragraph describes the procedure that must be followed in relation to 
the making of the first regulations under each of sub-paragraphs (1), (2) and 
(3) of paragraph 1. 


In the case of regulations under paragraph 1(1), within the period of six 
months beginning with the day on which this Act is passed, OFCOM must 
carry out research into the relationship between — 
(a) the dissemination of content that is harmful to adults by means of 
regulated user-to-user services, and 
(b) the number of users and functionalities of such services. 


In the case of regulations under paragraph 1(2), within the period of six 
months beginning with the day on which this Act is passed, OFCOM must 
carry out research into — 

(a) the prevalence of illegal content and content that is harmful to 
children presented to users by operation of the search engines of 
regulated search services in response to search requests made by 
users, 

(b) the number of users of such services, and 

(c) such other factors as OFCOM consider to be relevant to the 
specifying of Category 2A threshold conditions. 


In the case of regulations under paragraph 1(3), within the period of six 
months beginning with the day on which this Act is passed, OFCOM must 
carry out research into — 

(a) the dissemination of illegal content, content that is harmful to 
children and content that is harmful to adults by means of regulated 
user-to-user services, 

(b) the number of users and functionalities of such services, and 


(c) such other factors as OFCOM consider to be relevant to the 
specifying of Category 2B threshold conditions. 


OFCOM must provide the Secretary of State with advice based on the 
research under sub-paragraph (2), (3) or (4) (as the case may be) as to the 
provision which OFCOM consider it is appropriate for the regulations in 
question to make. 
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(6) 


(9) 


(10) 


(11) 


In the case of — 

(a) regulations under paragraph 1(2), or 

(b) regulations under paragraph 1(3), 
such advice may include advice that the regulations should include another 
factor in addition to number of users and (in the case of regulations under 
paragraph 1(3)) functionalities, and what that other factor should be. 


As soon as reasonably practicable after OFCOM provide advice as 
mentioned in sub-paragraph (5) — 

(a) OFCOM must publish the advice, and 

(b) the Secretary of State must make the regulations. 


If the regulations include provision which differs in any material respect 
from provision advised by OFCOM, the Secretary of State must publish a 
statement which explains why the Secretary of State has departed from that 
advice. 


A statement mentioned in sub-paragraph (8) must be published — 
(a) no later than the time at which the regulations to which the statement 
relates are made, and 
(b) in such manner as the Secretary of State considers appropriate for 
bringing it to the attention of persons who may be affected by it. 


The Secretary of State may give OFCOM extra time to carry out their 
research in the case of regulations under paragraph 1(2) or (3), but OFCOM 
must carry out such research within the period of 18 months beginning with 
the day on which this Act is passed. 


The Secretary of State may not make regulations under paragraph 1 until 
OFCOM have carried out research and provided advice to the Secretary of 
State as required by this paragraph. 


Procedure for amending or replacing regulations under paragraph 1 


3 


(1) 


(4) 


(5) 


Regulations in force under paragraph 1(1) may not be amended or replaced 
by further regulations under that provision except following further 
research carried out by OFCOM into the matters mentioned in paragraph 
2(2). 


Regulations in force under paragraph 1(2) may not be amended or replaced 
by further regulations under that provision except following further 
research carried out by OFCOM into the matters mentioned in paragraph 
2(3). 


Regulations in force under paragraph 1(3) may not be amended or replaced 
by further regulations under that provision except following further 
research carried out by OFCOM into the matters mentioned in paragraph 
2(4). 


OFCOM may initiate the further research in question or may carry it out in 
response to a request from the Secretary of State, and the depth of the 
research may be such as OFCOM consider appropriate. 


A request from the Secretary of State to OFCOM to carry out further research 
must indicate why the Secretary of State considers that to be necessary. 
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(6) Where such research is carried out, OFCOM must provide the Secretary of 
State with advice as to whether, in OFCOM’s opinion — 
(a) it is appropriate to make changes to the regulations in question, 
specifying the changes that OFCOM recommend, or 
(b) it is not appropriate to make any changes to the regulations in 
question. 


7) OFCOM must publish such advice as soon as reasonably practicable after 
p y P 
providing it to the Secretary of State. 


(8) Where, following such advice, regulations are amended or replaced by 
further regulations under the provision in question (“new regulations”) — 
(a) if the new regulations include provision which differs in any 
material respect from provision advised by OFCOM, the Secretary of 
State must publish a statement explaining the departures from that 
advice; 
(b) if OFCOM’s advice was as mentioned in sub-paragraph (6)(b), the 
Secretary of State must publish a statement explaining the reasons 
for the new regulations. 


(9) Where OFCOM’s advice is as mentioned in sub-paragraph (6)(a) and the 
Secretary of State does not make new regulations, the Secretary of State 
must, as soon as reasonably practicable, publish a statement explaining that 
decision. 


(10) A statement mentioned in sub-paragraph (8) must be published no later 
than the time at which the regulations to which the statement relates are 
made. 


(11) A statement mentioned in sub-paragraph (8) or (9) must be published in 
such manner as the Secretary of State considers appropriate for bringing it 
to the attention of persons who may be affected by it. 


(12) Sub-paragraphs (1) to (3) do not apply to regulations made only for the 
purpose of correcting existing regulations under paragraph 1. 


Publication of OFCOM’s advice under paragraphs 2 and 3 


4 (1) In arranging for the publication of advice under paragraph 2(7)(a) or 3(7), 
OFCOM must have regard to the need to exclude from publication, so far as 
that is practicable, matters which are confidential in accordance with sub- 
paragraphs (2) and (3). 

(2) A matter is confidential under this sub-paragraph if — 
(a) it relates specifically to the affairs of a particular body, and 


(b) publication of that matter would or might, in OFCOM’s opinion, 
seriously and prejudicially affect the interests of that body. 


(3) A matter is confidential under this sub-paragraph if — 
(a) it relates to the private affairs of an individual, and 


(b) publication of that matter would or might, in OFCOM’s opinion, 
seriously and prejudicially affect the interests of that individual. 


(4) The publication of advice under paragraph 2(7)(a) or 3(7) must be in such 
manner as OFCOM consider appropriate. 
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Interpretation 
5 References in this Schedule to the number of users of a service are to the 
number of United Kingdom users of a service. 
6 In this Schedule — 


“content that is harmful to adults” has the meaning given by section 46; 

“content that is harmful to children” has the meaning given by section 
45; 

“illegal content” has the meaning given by section 41. 


SCHEDULE 5 Section 77 
POWERS OF ENTRY AND INSPECTION 
Authorised persons 


1 (1) OFCOM may authorise persons to— 
(a) exercise powers of entry and inspection under paragraph 2; 
(b) apply for a warrant to be issued under paragraph 3, and execute such 
a warrant that has been issued. 


(2) “Authorised person” means — 
(a) in paragraph 2, a person authorised for the purposes mentioned in 
sub-paragraph (1)(a); 
(b) in other paragraphs of this Schedule, a person authorised for the 
purposes mentioned in sub-paragraph (1)(b). 


(3) An authorisation under this paragraph must be in writing. 
Power of entry and inspection without a warrant 


2 (1) The powers conferred by this paragraph may be exercised in relation to 
premises only if OFCOM — 

(a) believe that the premises are being used by the provider of a 
regulated service in connection with the provision of a regulated 
service, and 

(b) have given the occupier of the premises seven days’ notice that they 
propose to exercise the powers. 


(2) The powers conferred by this paragraph must be exercised at a reasonable 
hour. 


(3) Before exercising a power of entry under this paragraph, an authorised 
person must, if requested to do so by a person on the premises — 
(a) produce evidence of the authorised person’s identity, and 
(b) outline the purpose for which the power is exercised. 


(4) An authorised person may — 
(a) enter the premises, 
) inspect the premises, 
(c) observe the carrying on of the regulated service by the provider, 
) inspect any document or equipment found on the premises, 
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(e) require any person on the premises to produce any document or 
record in the person’s possession or control that the authorised 
person considers is relevant to the provision of the regulated service, 
and 

(f) require any person on the premises to provide an explanation of any 
document or to state where it may be found. 


(5) An authorised person may take copies of, or make extracts from, any 
document found or produced under sub-paragraph (4). 


(6) An authorised person may exercise powers under this paragraph only if the 
information or document sought to be obtained as a result is required in 
connection with the exercise by OFCOM of their functions under this Act. 


Conditions for issue of a warrant 


3 (1) A justice may issue a warrant in relation to premises specified in an 
application only if the justice is satisfied on sworn information in writing 
given by an authorised person that — 

(a) the premises are being used by the provider of a regulated service in 
connection with the provision of a regulated service; 
(b) there are reasonable grounds to suspect that— 


(i) the provider is failing to comply, or has failed to comply, 
with an enforceable requirement in respect of that service, 
and 


(ii) there are documents or records on the premises or capable of 
being viewed using equipment on the premises, or there is 
equipment on the premises, relevant to OFCOM’s 
investigation into that failure (or possible failure); and 


(c) any of the conditions in sub-paragraph (2) are satisfied. 


(2) The conditions are that — 
(a) OFCOM have given seven days’ notice to the occupier of the 
premises demanding access to the premises and — 


(i) access to the premises was demanded at a reasonable hour 
and was unreasonably refused, or 


(ii) entry to the premises was granted but the occupier 
unreasonably refused to comply with a request by a person 
acting on behalf of OFCOM to be allowed to do any of the 
things mentioned in paragraph 5; 

(b) compliance with the conditions in paragraph (a) would defeat the 
object of entry to the premises; or 
(c) OFCOM require access to the premises urgently. 


(3) In this paragraph “enforceable requirement” means — 


(a) aduty or requirement referred to in section 82, except that it does not 
include a reference to a requirement referred to in paragraph (t), (u) 
or (w) of that section, and 


b) a requirement imposed by a use of technology notice given to the 
q p y 8y 8 
provider in question under section 64, 65 or 67. 


Evidence of authority 


4 (1) Before exercising a power of entry under a warrant — 
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(a) 


(b) 


an authorised person must, if requested to do so— 
(i) produce evidence of the authorised person’s identity, and 
(ii) outline the purpose for which the power is exercised; 
an authorised person must — 
(i) produce a copy of the warrant, and 
(ii) supply the occupier (if present), or any other person 
appearing to the authorised person to be in charge of the 
premises, with a copy of the warrant. 


(2) If neither the occupier nor any other person appearing to the authorised 
person to be in charge of the premises is present, the authorised person must 
leave a copy of the warrant in a prominent place on the premises. 


Powers exercisable by warrant 


5 A warrant must authorise an authorised person — 


(a) 
(b) 


to enter the premises specified in the warrant, 

to search the premises, to the extent that is reasonable for the 
purposes of OFCOM’s investigation into whether there is, or has 
been, a failure referred to in paragraph 3(1)(b)(i) (“OFCOM’s 
investigation”), 

to inspect any documents, records or equipment found on the 
premises which may be relevant to OFCOM’s investigation, 

to require any person on the premises to provide any information 
that the authorised person thinks is or is likely to be relevant to 
OFCOM’s investigation, including requiring an explanation of any 
document or record found on the premises or capable of being 
viewed using equipment on the premises, 

to require any person on the premises to give the authorised person 
any other assistance that the authorised person may reasonably 
require, 

to require any person on the premises to produce any document or 
record in the person’s possession or control that the authorised 
person thinks is or is likely to be relevant to OFCOM’s investigation, 
to take copies of, or extracts from, any document or record found on 
the premises or produced in response to a requirement under 
paragraph (f), 

to require information which is stored in electronic form and is 
accessible from the premises to be produced in a form in which it can 
be taken away and in which it is visible and legible (or from which it 
can readily be produced in a visible and legible form), 

to take copies of, or extracts from, anything produced in accordance 
with paragraph (h) that the authorised person thinks is or is likely to 
be relevant to OFCOM’s investigation, 

to seize any document or record found on the premises or produced 
in response to a requirement under paragraph (f), or anything 
produced in accordance with paragraph (h), or any equipment found 
on the premises, that the authorised person reasonably believes is or 
is likely to be relevant to OFCOM’s investigation, 

to open any container found on the premises that the authorised 
person thinks is or is likely to be relevant to OFCOM’s investigation, 
and 
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(l) to take a photograph or video recording of anything found on the 
premises that the authorised person thinks is or is likely to be 
relevant to OFCOM’s investigation. 


Powers of seizure: supplementary 


6 (1) 


(2) 


This paragraph applies where the person executing a warrant seizes a 
document, record or other thing. 


The person must, on request — 
(a) give a receipt for it, and 


(b) (inthe case of a document or record) give an occupier of the premises 
a copy of it. 


Sub-paragraph (2)(b) does not apply if the person executing the warrant 
considers that providing a copy would result in undue delay. 


Anything seized may be retained for so long as is necessary in all the 
circumstances. 


Further provision about executing warrants 


7 


10 


11 


12 
13 


Entry and search under a warrant must be at a reasonable hour, unless it 
appears to the person executing it that the purpose of a search would be 
frustrated or seriously prejudiced by entry at a reasonable hour. 


Entry and search under a warrant must be within the period of one month 
starting with the date of its issue. 


An authorised person executing a warrant may take such other persons and 
such equipment and materials onto the premises as appear to that person to 
be necessary. 


A person taken on to the premises under paragraph 9 may exercise any 
power conferred on an authorised person by paragraph 5 if the person is in 
the company and under the supervision of an authorised person executing 
a warrant. 


An authorised person may use reasonable force, if necessary, for the 
purpose of exercising a power under a warrant. 


A warrant authorises entry on one occasion only. 


If the premises are unoccupied or the occupier is temporarily absent, an 
authorised person executing a warrant must leave the premises as 
effectively secured against trespassers as that person found them. 


Return of warrants 


14 (1) 


(2) 


Where a warrant is executed — 
(a) it must be returned to the appropriate person (see sub-paragraph (3)) 
after being executed, and 
(b) the person by whom it is executed must write on the warrant a 
statement of the powers that have been exercised under the warrant. 


Where a warrant is not executed, it must be returned to the appropriate 
person within the time authorised for its execution. 
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(3) The appropriate person is — 

(a) inthe case of a warrant issued in England and Wales, the designated 
officer for the local justice area in which the justice of the peace was 
acting when issuing the warrant; 

(b) in the case of a warrant issued in Scotland, the clerk of the justice of 
the peace court; 


(c) inthe case of a warrant issued in Northern Ireland, the clerk of petty 
sessions. 


4) The appropriate person must retain a search warrant returned under sub- 
Pprop p 
paragraph (1) or (2) until the end of the period of 12 months starting with the 
date of its return. 


(5) If during that period the occupier of premises to which the warrant relates 
asks to inspect it, the occupier must be allowed to do so. 


Restrictions on powers under paragraphs 2 and 3 


15 (1) This paragraph applies in relation to — 
(a) powers conferred by paragraph 2 (entry and inspection without 
warrant), and 
(b) powers exercisable under a warrant. 


(2) Those powers are not exercisable in respect of a dwelling. 


(3) Those powers are not exercisable in relation to information or documents in 
respect of which a claim to legal professional privilege (or, in Scotland, to 
confidentiality of communications) could be maintained in legal 


proceedings. 
Interpretation 
16 In this Schedule “premises” means premises in the United Kingdom. 
17 In paragraphs 4 to 15 “warrant” means a warrant issued under paragraph 3. 
18 In paragraph 3 “justice” means — 


(a) in England and Wales, a justice of the peace; 
(b) in Scotland, a justice of the peace; 
(c) in Northern Ireland, a lay magistrate. 


19 In the application of paragraph 3(1) to Scotland, the reference to sworn 
information in writing has effect as a reference to evidence on oath. 


20 In the application of paragraph 3(1) to Northern Ireland, the reference to 
sworn information in writing has effect as a reference to a complaint on oath. 
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